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Inside the black box: a glimpse of Google’s internal data free-for-all. 


The GDPR “purpose limitation principle” requires that 
personal data is “collected for specified, explicit and 
legitimate purposes and not further processed in a manner 
that is incompatible with those purposes”. This is at odds 


with the data free-for-all shown here. 


Sources: 


are cited. 


All quotations in the table are directly from Google’s own 
documents for business clients, technology partners, 
developers, lawmakers, and users. Almost 100 documents 


Note: 
This table is not a complete list of Google purposes, or of 


the details of each purpose. Some may duplicate others. 


Many more are so ill-defined by Google that they conflate 


multiple purposes. 





Category [Purported processing purpose 





Other discoverable processing purposes 


Data collected 


Data shared externally 


Explanation and examples Purported legal basis 











“purposes such as accounting...”? 


“Such as...”? is vague language that may conflate 
or omit many distinct processing purposes. 


“For example, when you purchase apps from the Play 
Store or products from the Google Store.”* 





“purposes such as ... dispute resolution ...”* 


“such as...”° is vague language that may conflate 


or omit many distinct processing purposes. 


“For example, when you purchase apps from the Play 
Store or products from the Google Store.”” 





“purposes such as... compliance with tax ...”® 


“such as...”° is vague language that may conflate 
or omit many distinct processing purposes. 


“For example, when you purchase apps from the Play 
Store or products from the Google Store.” ° 





“purposes such as... escheatment...”" 


“such as...” is vague language that may conflate 


or omit many distinct processing purposes. 


“For example, when you purchase apps from the Play 
Store or products from the Google Store.” 





“purposes such as... anti-money laundering 
14 


“such as...” 1 is vague language that may conflate 


or omit many distinct processing purposes. 


“For example, when you purchase apps from the Play 
Store or products from the Google Store.” 16 





“purposes such... other financial 
regulations.” ” 


“such as...” 1 is vague language that may conflate 


or omit many distinct processing purposes. 





“For example, when you purchase apps from the Play 
Store or products from the Google Store.” 1° 





“To serve ads in services where cookie 
technology may not be available (for 
example, in mobile applications)””° 


This vague language may conflate or omit many 
distinct processing purposes. 


“Advertising identifiers for mobile apps ... We may use 
technologies that perform similar functions to cookies”?! 





“to coordinate ads across your mobile apps 
and mobile browser’? 


“Advertising identifiers for mobile apps ... Sometimes Google 
links the identifier used for advertising on mobile 
applications to an advertising cookie on the same device”? 





“Google Ad Manager collects data to provide the 
relevant services, including: ... To apply publisher 
configurations and rules, such as protections, 
blocks and minimum prices; ...”4 


“Depending on the publisher’s settings, the user’s 
preferences and the device in question, the collected 
data may include: 

The request itself, such as the browser’s request foran 
ad to be served ona non-Google website and the ad 
slot to be filled; System and device information, such 
as the device, browser version, operating system 
version, default language and screen size; IP address; 
Location; The date and time of the request; In the 
case of web browsers, the full URL of the page being 
visited together with the referrer URL; In the case of 
mobile devices, mobile network information; In the 
case of mobile applications, an identifier for the 
application and a resettable mobile advertising 
identifier (such as IDFA for iOS or AdID for Android); In 
the case of web browsers, any cookie IDs that Google 
has previously set on the user’s device; and Event 
data such as impression, click, or conversion data. 
Google Ad Manager may also collect such data 
through tags on the publisher’s property or the Google 
Mobile Ads software development kit (SDK) on the 
user’s app. 

It can also collect publisher-provided IDs. In addition, 
Google Ad Manager allows publishers to integrate 
audience data, such as audience lists and lists of 
cookie IDs with inferred interests, from their own data 
management platform.”?° 











“Best times of day to target a campaign’””© 
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Category Purported processing purpose Other discoverable processing purposes Data collected Data shared externally Explanation and examples 








“to link your activity across devices if you’ve “We also use cookies named ‘AID,’ ‘DSID,’ and 
previously signed in to your Google Account “TAID’”® 

on another device. We do this to coordinate 
the ads you see across devices...”°’ 





“Google Ad Manager collects data to provide the “Depending on the publisher's settings, the user’s 
relevant services, including: ... To forecast preferences and the device in question, the collected 
available traffic (e.g., the number of potential ad data may include: 

impressions available to an ad campaign targeted The request itself, such as the browser’s request foran 
to a specific country or device type); ...”*° ad to be served on a non-Google website and the ad 


slot to be filled; System and device information, such 
as the device, browser version, operating system 
version, default language and screen size; IP address; 
Location; The date and time of the request; In the 
case of web browsers, the full URL of the page being 
visited together with the referrer URL; In the case of 
mobile devices, mobile network information; In the 
case of mobile applications, an identifier for the 
application and a resettable mobile advertising 
identifier (such as IDFA for iOS or AdID for Android); In 
the case of web browsers, any cookie IDs that Google 
has previously set on the user’s device; and Event 
data such as impression, click, or conversion data. 
Google Ad Manager may also collect such data 
through tags on the publisher's property or the Google 
Mobile Ads software development kit (SDK) on the 
user’s app. 

It can also collect publisher-provided IDs. In addition, 
Google Ad Manager allows publishers to integrate 
audience data, such as audience lists and lists of 
cookie IDs with inferred interests, from their own data 
management platform.”°° 





“Google Ad Manager collects data to provide the “Depending on the publisher’s settings, the user’s 
relevant services, including: ... To enable preferences and the device in question, the collected 
frequency capping (i.e., to ensure that users are data may include: 

not served the same ad multiple times); ....”3* The request itself, such as the browser’s request for an 


ad to be served on a non-Google website and the ad 
slot to be filled; System and device information, such 
as the device, browser version, operating system 
version, default language and screen size; IP address; 
Location; The date and time of the request; In the 
case of web browsers, the full URL of the page being 
visited together with the referrer URL; In the case of 
mobile devices, mobile network information; In the 
case of mobile applications, an identifier for the 
application and a resettable mobile advertising 
identifier (such as IDFA for iOS or AdID for Android); In 
the case of web browsers, any cookie IDs that Google 
has previously set on the user’s device; and Event 
data such as impression, click, or conversion data. 
Google Ad Manager may also collect such data 
through tags on the publisher's property or the Google 
Mobile Ads software development kit (SDK) on the 
user’s app. 

It can also collect publisher-provided IDs. In addition, 
Google Ad Manager allows publishers to integrate 
audience data, such as audience lists and lists of 
cookie IDs with inferred interests, from their own data 
management platform.” 





“Google Ad Manager collects data to provide the “Depending on the publisher's settings, the user’s 
relevant services, including: ... To maximize preferences and the device in question, the collected 
publisher yield through optimizations ...”? data may include: 

The request itself, such as the browser’s request for an 
ad to be served on a non-Google website and the ad 
slot to be filled; System and device information, such 
as the device, browser version, operating system 
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Category Purported processing purpose Other discoverable processing purposes Data collected Data shared externally Explanation and examples 








version, default language and screen size; IP address; 
Location; The date and time of the request; In the 
case of web browsers, the full URL of the page being 
visited together with the referrer URL; In the case of 
mobile devices, mobile network information; In the 
case of mobile applications, an identifier for the 
application and a resettable mobile advertising 
identifier (such as IDFA for iOS or AdID for Android); In 
the case of web browsers, any cookie IDs that Google 
has previously set on the user’s device; and Event 
data such as impression, click, or conversion data. 
Google Ad Manager may also collect such data 
through tags on the publisher's property or the Google 
Mobile Ads software development kit (SDK) on the 
user’s app. 

It can also collect publisher-provided IDs. In addition, 
Google Ad Manager allows publishers to integrate 
audience data, such as audience lists and lists of 
cookie IDs with inferred interests, from their own data 





management platform.” 
“Google Ad Manager collects data to provide the “Depending on the publisher’s settings, the user’s 
relevant services, including: ... To maximize preferences and the device in question, the collected 
publisher yield through... real time bidding; ...”>“ data may include: 


The request itself, such as the browser’s request foran 
ad to be served on a non-Google website and the ad 
slot to be filled; System and device information, such 
as the device, browser version, operating system 
version, default language and screen size; IP address; 
Location; The date and time of the request; In the 
case of web browsers, the full URL of the page being 
visited together with the referrer URL; In the case of 
mobile devices, mobile network information; In the 
case of mobile applications, an identifier for the 
application and a resettable mobile advertising 
identifier (such as IDFA for iOS or AdID for Android); In 
the case of web browsers, any cookie IDs that Google 
has previously set on the user’s device; and Event 
data such as impression, click, or conversion data. 
Google Ad Manager may also collect such data 
through tags on the publisher’s property or the Google 
Mobile Ads software development kit (SDK) on the 
user’s app. 

It can also collect publisher-provided IDs. In addition, 
Google Ad Manager allows publishers to integrate 
audience data, such as audience lists and lists of 
cookie IDs with inferred interests, from their own data 
management platform.”*> 





“Google Ad Manager collects data to provide the “Depending on the publisher's settings, the user’s 
relevant services, including: ... To enable preferences and the device in question, the collected 
sequential creative rotation (i.e., to show a set of data may include: 

ads to users in a specific sequence); ...”°° The request itself, such as the browser’s request for an 


ad to be served on a non-Google website and the ad 
slot to be filled; System and device information, such 
as the device, browser version, operating system 
version, default language and screen size; IP address; 
Location; The date and time of the request; In the 
case of web browsers, the full URL of the page being 
visited together with the referrer URL; In the case of 
mobile devices, mobile network information; In the 
case of mobile applications, an identifier for the 
application and a resettable mobile advertising 
identifier (such as IDFA for iOS or AdID for Android); In 
the case of web browsers, any cookie IDs that Google 
has previously set on the user’s device; and Event 
data such as impression, click, or conversion data. 
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Google Ad Manager may also collect such data 
through tags on the publisher's property or the Google 
Mobile Ads software development kit (SDK) on the 
user’s app. 

It can also collect publisher-provided IDs. In addition, 
Google Ad Manager allows publishers to integrate 
audience data, such as audience lists and lists of 
cookie IDs with inferred interests, from their own data 
management platform.”?” 





“Real-time bidding”? covers a multitude of 
purposes, and since the information sharing 
involved is boundless, the range of purposes that 
may result from it is boundless too. 


“id..., google_user_id..., hosted_match_data..., 
user_agent...., geo_criteria_id..., postal_vode..., 
encrypted_hyper_local_set, hyperlocal_set..., 
user_vertical..., user_list..., url..., detected_vertical..., 
latitude, longitude, ... hyperlocal, center_point, ... userlist id, 
userlist age_seconds, ... vertical object id, vertical object 
weight, ... device os_version, device carrier_id, device 
screen_width, device screen_height, device 
screen_pixel_ratio_millis, device_platform, device_brand, 
device_model, device hardware_version, OsVersion major 
minor micro, ...encrypted_advertising_id, 
encrypted_hashed_idfa, advertising_id, hashed_idfa, ... 
installedSdk id, Version major minor micro, ... 
consented_providers” *° 





Google’s sharing on 
personal data appears to be 
boundless. Data are 
broadcast to 833 “ad 
technology providers”*®° and 
may also be broadcast to 
2,033 “certified”! Google 
partners. There is no control 
over how the data are then 
processed by these 
companies, aside from 
Google’ request to be 
notified if its contractual 
provisions are breached.’? 





“Google uses the information shared by sites 
and apps to... , measure the effectiveness of 
advertising’”** 


This vague language may conflate or omit many 
distinct processing purposes. 


“For example, when you visit a website that uses advertising 
services like AdSense, including analytics tools like Google 
Analytics, or embeds video content from YouTube, your web 
browser automatically sends certain information to Google. 
This includes the URL of the page you’re visiting and your IP 
address. We may also set cookies on your browser or read 
cookies that are already there. Apps that use Google 
advertising services also share information with Google, 
such as the name of the app and a unique identifier for 
advertising.”“* 





“Providing advertising, which keeps many of 
our services free (and when ads are 


personalized, we ask for your consent)”*° 


This language is exceptionally broad and vague, 
and may conflate or omit many distinct processing 
purposes. 





“so we can provide aggregated reports to 
advertisers,”*” 


“we collect information about views and interactions with 
ads. ... We may also measure other interactions, such as how 
you move your mouse over an ad or if you interact with the 
page on which the ad appears.” 





“for advertising and ad measurement 
purposes...” °? 


This vague language may conflate or omit many 
distinct processing purposes. 


“Specific partners, listed below, can collect or receive non- 
personally identifiable information about your browser or 
device when you use Google sites and apps. These partners 
collect this information for advertising and ad measurement 
purposes, using their own cookies or similar technologies. 
For example, we allow YouTube creators and advertisers to 
work with measurement companies to learn about the 
audience of their YouTube videos or ads, using cookies or 
similar technologies. 

You can learn more about how these specific partners 
collect and use your information: Nielsen,comScore, Integral 
Ad Science, DoubleVerify, Oracle Data Cloud, Kantar, RN SSI 
Group”®? 


“For example, advertisers may upload data from their 
loyalty-card programs so that they can better understand 
the performance of their ad campaigns.”** 


“For example, we allow YouTube creators and 
advertisers to work with measurement companies to 
learn about the audience of their YouTube videos or 
ads, using cookies or similar technologies. ... Another 
example is merchants on our shopping pages who use 
cookies to understand how many different people see 
their product listings.” 5? 





“helps us improve the reports we give to our 
advertisers on the effectiveness of their 
campaigns.”®? 








“Advertising identifiers for mobile apps ... Sometimes Google 
links the identifier used for advertising on mobile 
applications to an advertising cookie on the same device”™* 














@ brave 








Purported processing purpose 


Other discoverable processing purposes 


Data collected 


Data shared externally 


Explanation and examples 








“Advertising. ... to make advertising more 
engaging to users and more valuable to 
publishers and advertisers. Some common 
applications of cookies are ... to improve 
reporting on campaign performance...” 55 


“Some common applications are...”°° suggests 
the existence of other purposes that are not 
specified. This vague language may conflate or 
omit many distinct processing purposes. 





“purposes such as measuring interactions 
with the ads on that domain .….” 57 


“Such as...”58 is vague language that may 


conflate or omit many distinct processing 
purposes. 


“Sometimes advertising cookies may be set on the 
domain of the site you’re visiting. In the case of 
advertising we serve across the web, cookies (e.g., 


Purported legal basis 


cookies named ‘__gads’ or ‘__gac’) may be set on the 
domain of the site you’re visiting. Unlike cookies that 
are set on Google’s own domains, these cookies can’t 
be read by Google when you’re on a site other than 


the one on which they were set.” °° 





uu 


‘session state cookies’ ... to anonymously 
measure the effectiveness of PPC (pay per 
click) and affiliate advertising.” ©? 


“For example, we use a cookie called 
‘recently_watched_video_id_list’ so that YouTube can 
record the videos most recently watched by a 
particular browser.” 5 





“.» to measure interactions with the ads we 
si h OW. n62 


“data collected on Google properties by Google 
Analytics may also be used, together with some of the 
advertising cookies described above”? 





“Google Ad Manager collects data to provide the 
relevant services, including: ... To measure ad 
performance (e.g., how many ads were served 
and how many clicks those ads received) and 
provide reporting” 


“Depending on the publisher's settings, the user’s 
preferences and the device in question, the collected 
data may include: 

The request itself, such as the browser’s request for an 
ad to be served on a non-Google website and the ad 
slot to be filled; System and device information, such 
as the device, browser version, operating system 
version, default language and screen size; IP address; 
Location; The date and time of the request; In the 
case of web browsers, the full URL of the page being 
visited together with the referrer URL; In the case of 
mobile devices, mobile network information; In the 
case of mobile applications, an identifier for the 
application and a resettable mobile advertising 
identifier (such as IDFA for iOS or AdID for Android); In 
the case of web browsers, any cookie IDs that Google 
has previously set on the user’s device; and Event 
data such as impression, click, or conversion data. 
Google Ad Manager may also collect such data 
through tags on the publisher's property or the Google 
Mobile Ads software development kit (SDK) on the 
user’s app. 

It can also collect publisher-provided IDs. In addition, 
Google Ad Manager allows publishers to integrate 
audience data, such as audience lists and lists of 
cookie IDs with inferred interests, from their own data 
management platform. 





“to help advertisers measure how often an 
online ad campaign helps drive traffic to 
physical stores or properties” %7 


This vague language may conflate or omit many 
distinct processing purposes. 


“Store visit conversions” are explained to advertisers 


in Google’s help documentation for business 
customers. 








“Advertising. ... to make advertising more 
engaging to users and more valuable to 





“,,.5ome common applications are...”’° suggests 
the existence of other purposes that are not 











“Sometimes advertising cookies may be set on the 
domain of the site you’re visiting. In the case of 
advertising we serve across the web, cookies (e.g., 
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Category Purported processing purpose 


Other discoverable processing purposes 


Data collected 


Data shared externally 


Explanation and examples 








publishers and advertisers. ...Some common 
applications of cookies are ...”°° 





specified. This vague language may conflate or 
omit many distinct processing purposes.. 


cookies named ‘__gads’ or ‘__gac’) may be set on the 
domain of the site you’re visiting. Unlike cookies that 
are set on Google’s own domains, these cookies can’t 
be read by Google when you’re on a site other than 


the one on which they were set.” 










“purposes such as... preventing the same ads 
from being shown to you too many times.” 7? 


“Such as...”7? is vague language that may 


conflate or omit many distinct processing 
purposes. 


“Sometimes advertising cookies may be set on the 
domain of the site you’re visiting. In the case of 
advertising we serve across the web, cookies (e.g., 
cookies named ‘__gads’ or ‘__gac’) may be set on the 
domain of the site you’re visiting. Unlike cookies that 
are set on Google’s own domains, these cookies can’t 
be read by Google when you’re on a site other than 
the one on which they were set.””* 





“to help advertisers determine how many 
times people who click on their ads end up 
taking an action on their site (e.g., making a 
purchase). These cookies allow Google and 
the advertiser to determine that you clicked 
the ad and later visited the advertiser’s 
site.”7> 






“Google also uses conversion cookies (e.g., cookies 
named ‘_ gcl’)... Some of our other cookies may be 
used to measure conversion events as well. For 
example, Google Marketing Platform and Google 


Analytics cookies may also be used for this purpose.” 





“to link your activity across devices if you’ve 
previously signed in to your Google Account 
on another device. We do this to ... measure 
conversion events.””” 






“We also use cookies named ‘AID,’ ‘DSID,’ and 
“TAID”? 










“Google uses the information shared by sites 
and apps to... personalize ... ads you see on 
Google ... sites and apps.” 7? 


“For example, when you visit a website that uses advertising 
services like AdSense, including analytics tools like Google 
Analytics, or embeds video content from YouTube, your web 
browser automatically sends certain information to Google. 
This includes the URL of the page you’re visiting and your IP 
address. We may also set cookies on your browser or read 
cookies that are already there. Apps that use Google 
advertising services also share information with Google, 
such as the name of the app and a unique identifier for 
advertising.” ® 









“We use your gender to make Google 
services more personal. ... help us to: ... 
provide more relevant, tailored content you 
might be interested in, like ads”.8! 


“wlike...”* is vague language that may conflate or 
omit many distinct processing purposes. 


“your gender’®* 








“Google uses the information shared by sites 
and apps to... personalize ... ads you see on 
.. our partners’ sites and apps.”** 





“For example, when you visit a website that uses advertising 
services like AdSense, including analytics tools like Google 
Analytics, or embeds video content from YouTube, your web 
browser automatically sends certain information to Google. 
This includes the URL of the page you’re visiting and your IP 
address. We may also set cookies on your browser or read 
cookies that are already there. Apps that use Google 
advertising services also share information with Google, 
such as the name of the app and a unique identifier for 
advertising.”*> 










“Some ways Google uses your birthday. 
Determine your age group for personalized 
recommendations and ads...” 





“some ways...” and “...ads...” is vague language 
that may conflate or omit many distinct processing 
purposes.®” 










“helps Google give you more personalised 
experiences across Google services, such as ... 
useful ads, both on and off Google.”** 





“such as...”®° is vague language that may conflate 
or omit many distinct processing purposes. 





“Additional Web & App Activity saves your activity from 
sites, apps and devices that use Google services, including: 
activity from sites and apps that partner with Google to 
show ads 

Chrome history (if Chrome Sync is turned on) 

app activity, including data that apps share with Google 
Android usage & diagnostics, such as battery level, how 
often you use your device and apps, and system errors 

... This data may be saved and used in any Google service 
where you are signed in...”°° 





“both on and off Google” 
is vague language that may 
indicate extensive or minor 
data sharing with an 
unknowable number 
Google’s business 
partners.+ 











Purported legal basis 
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Other discoverable processing purposes 


Data collected 


Data shared externally 


Explanation and examples 














“This data helps Google give you more 

personalised experiences across Google 
services, such as... useful ads, both on and 
off Google.”°* 








“such as...”°? is vague language that may conflate 
or omit many distinct processing purposes. 


“Location History saves where you go with your devices. To 
save this data, Google regularly obtains location data from 
your devices. This data is saved even when you aren’t using 
a specific Google service, such as Google Maps or Search. ... 
This data may be saved and used in any Google service 
where you are signed in to give you more personalised 
experiences.” 


“both on and off Google” 
is vague language that may 
indicate extensive or minor 
data sharing with an 
unknowable number 
Google’s business 
partners.’ 





“Gmail ads are based on your activity” ° 





This vague language may conflate or omit many 
distinct processing purposes. 


“The ads that you see in Gmail are based on data associated 
with your Google account. For example, your activity in 
other Google services such as YouTube or Search could affect 
the types of ads that you see in Gmail.” ” 










“Google Play ads help you discover apps that 
you might like”? 


“When you browse on an Android device, ads may appear 
based on your search terms, apps that you’ve installed or 
used, or an app’s similarity to the app that you’re using.” ® 


“When you browse on an Android device, ads may 
appear based on your search terms, apps that you’ve 
installed or used, or an app’s similarity to the app that 
you’re using.” 









“Search ads use your activity to be more 
personally relevant 


101 





“Most of the time, these ads are prompted by the search 
that you just did and your location. For example, if you 
search for ‘bikes’, you might see ads for bicycles on sale near 
you. In other cases, we use additional data like your past 
searches or sites that you have visited to help deliver more 
useful ads.” 1% 


“Since you have already searched for ‘bikes’, if you 
now search for ‘holidays’ you might see Search ads for 
places to go cycling while on holiday.” 1% 











“Shopping Ads help you find what you’re 
looking for’*™* 


“These ads are based on the product that you just searched 
for, your location and online retailers that you’ve browsed in 
the past.” 1% 


“For example, if you search for ‘leather sofa’, you may 
see ads with pictures, prices and shop locations for 
leather sofas on sale at furniture shops near you.” 8 











“YouTube ads use your search and watch 
activity to be more relevant” 


“Ads may be based on data such as the videos that you’ve 
watched, things or places that you’ve searched for or apps 
that you use.” 18 


“For example, if you search for ‘home decor’ or watch 
do-it-yourself videos, you might see an ad fora home 
improvement series.” 109 










“This info helps Google show ads that may be 
useful to you.” ° 


This vague language may conflate or omit many 
distinct processing purposes. 


“your activity on: Google services (such as Search or 
YouTube) 
Websites and apps that partner with Google to show ads” 11 


“Personalization applies to [REDACTED-EMAIL- 
ADDRESS] across your devices. For example, if you visit 
a travel website on your home computer in the 
morning, you might see ads about train tickets on your 
phone later that day.” +? 











“Advertising... Google uses cookies like NID 
and SID to help customize ads on Google 
properties, like Google Search.” 1° 


“we use such cookies to remember your most recent 
searches, your previous interactions with an advertiser’s ads 
or search results, and your visits to an advertiser’s website. 
This helps us to show you customized ads on Google.”**> 













“We also use one or more cookies for 
advertising we serve across the web... on 
non-Google sites. ... Google properties, like 
YouTube, may also use these cookies to show 
you more relevant ads.” 115 


“One of the main advertising cookies on non-Google 
sites is named ‘IDE’ and is stored in browsers under the 
domain doubleclick.net. Another is stored in 
google.com and is called ANID. We use other cookies 
with names such as DSID, FLC, AID, TAID, and 
exchange_uid.”"*” 










“to help show more relevant ads on Google 
properties (like Google Search) and across 
the web...” "8 


This vague language may conflate or omit many 
distinct processing purposes. 


“data collected on Google properties by Google 
Analytics may also be used, together with some of the 
advertising cookies described above” 





“helps us show you ... more relevant ads...” ° 








This vague language may conflate or omit many 
distinct processing purposes. 





“your searches and activity from a number of other Google 
services are saved to your Google Account. The activity 
saved to Web & App Activity may also include location 
information... The location used and stored with your Web & 
App Activity can come from signals like the device’s IP 
address, your past activity, or from your device, if you’ve 
chosen to turn on your device’s location settings.” ‘21 











Purported legal basis 
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Purported processing purpose 


Other discoverable processing purposes 


Data collected 


Data shared externally 


Explanation and examples 








“to make ads more useful to you on websites 
and apps...” 122 


This vague language may conflate or omit many 
distinct processing purposes. 


“By including non-Google activity, Google will: ... 
Use Google Account activity to make ads more useful to you 
on websites and apps...” 3 





“to make ads more useful to you on websites 
and apps...” 124 


This vague language may conflate or omit many 
distinct processing purposes. 


“By including non-Google activity, Google will: 

Include your browsing data from non-Google websites and 
apps that partner with Google, including those that show 
ads from Google, in your Google Account 

Store that data with other data in your Google Account 
based on your activity controls preferences... 

, and improve Google services 

This setting applies across all of your signed-in devices and 
across all Google services.” 1° 





“Ads can be served based on your general 
location’*26 


This vague language may conflate or omit many 
distinct processing purposes. 


“This can include location derived from the device’s IP 
address. Depending on your ads personalization settings, 
you may also see ads based on your activity in your Google 
Account. This includes activity stored in your Web & App 
Activity, which can be used for more useful ads. Another 
example is if you have enabled Location History and 
regularly frequent ski resorts, you might later see an ad for 
ski equipment when watching a video on YouTube.”'2’ 





“personalized ads based on your interests” ?8 


This vague language may conflate or omit many 
distinct processing purposes. 


“Reasons you might see an ad 

Your info: 

Info in your Google Account, like your age range and gender 
Your general location 

Your activity: 

Your current search query 

Previous search activity 

Your activity while you were signed in to Google 

Your previous interactions with ads 

Types of websites you visit 

Types of mobile app activity on your device 

Your activity on another device 

Other info: 

The time of day 

Info you gave to an advertiser, like if you signed up fora 
newsletter with your email address 

Google can personalize ads so they’re more useful to you. 
Personalized ads aren’t shown or hidden from you based on 
sensitive categories, like race, religion, sexual orientation, or 
health.” 


“Unique identifiers can be used for ... providing 
personalized advertising.” 1° 


“For example, if you search for “mountain bikes,” you 
may see an ad for sports equipment when you’re 
browsing a site that shows ads served by Google. You 
can control what information we use to show you ads 
by visiting your ad settings.” °! 


“You may also see personalized ads based on 
information from the advertiser. If you shopped on an 
advertiser’s website, for example, they can use that 
visit information to show you ads.” +32 


“For example, we may think that you’re a football fan 
because you watched highlights from a recent match 
on YouTube, or looked up ‘football fields near me’ on 
Google Search. And if you’ve spent time on a partner 
advertiser’s site, we may suggest ads based on that 
visit.” 33 


“Depending on your Ad Settings and if you’re signed 
in, this data informs the ads that you see across your 
devices and across sites that partner with us to show 
ads. So if you visit a travel website on your computer 
at work, you might see other ads served by Google 
about airfares to Paris on your phone later that 
night.” 





“Partner websites and apps use your online 
activity to create ads that are more useful to 
you” 135 


This vague language may conflate or omit many 
distinct processing purposes. 


“When we show ads on these partners’ sites and apps, they 
are based on what you’re reading or watching, audience 
‘types’ based on personal information that our users have 
shared with us, and data that we collect about your online 
activities” 3° 


“for instance, ‘35- to 44-year-old females who are 
interested in travel’. ... For example, you might see an 
ad for those hiking shoes that you added to your 
online shopping basket but decided not to buy. .” 137 





“to... make the ads you see more relevant to 
you.”38 


This vague language may conflate or omit many 
distinct processing purposes. 


“If you add your phone number to your account”??? 


“If “Ads Personalization” is turned on, your phone 
number might be used to make the ads you see more 
relevant to you. For example, if you use your phone 
number for a loyalty program, you might see related 
ads while using Google Search.” 1° 





“This data helps Google give you more 
personalised experiences across Google 
services, such as... useful ads, both on and 
off Google.”*** 





“such as...”"“? is vague language that may 
conflate or omit many distinct processing 
purposes. 





“YouTube search history saves your YouTube searches. ... 
This data may be saved and used in any Google service 
where you are signed in to give you more personalised 
experiences.” 1? 





“both on and off Google” 
is vague language that may 
indicate extensive or minor 
data sharing with an 
unknowable number 
Google’s business 
partners.144 
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“This data helps Google give you more 
personalised experiences across Google 
services, such as... useful ads, both on and 
off Google.” “5 


“such as...”"“° is vague language that may 
conflate or omit many distinct processing 
purposes. 


“YouTube watch history saves the YouTube videos you 
watch and listen to. ... This data may be saved and used in 
any Google service where you are signed in to give you more 
personalised experiences.” 


“both on and off Google” 
is vague language that may 
indicate extensive or minor 
data sharing with an 
unknowable number 
Google’s business 
partners. “8 

















measurement service to customers” 1°! 








measure user interactions with a customer's sites and/or 
apps, while IP addresses are used to provide and protect the 
security of the service, and to give the customer a sense of 
where in the world their users come from.” 1° 


“First-party Cookies 

Google Analytics collects first-party cookies, data related to 
the device/browser, IP address and on-site/app activities to 
measure and report statistics about user interactions on the 
websites and/or apps that use Google Analytics. Customers 
may customize cookies and the data collected with features 
like cookie settings, User-ID, Data Import, and Measurement 
Protocol. ... 

Google Analytics customers who have for instance, enabled 
the analytics.js or gtag.js collection method can control 
whether or not they use cookies to store a pseudonymous or 
random client identifier. If the customer decides to set a 
cookie, the information stored in the local first-party cookie 
is reduced to a random identifier (e.g., 12345.67890). 

For customers who use the Google Analytics for Apps SDK, 
we collect an App Instance Identifier, which is a number that 
is randomly generated when the user installs an app for the 
first time. 


Advertising identifiers 

Where customers use Google Analytics Advertising Features, 
Google advertising cookies are collected and used to enable 
features like Remarketing on the Google Display Network. 
These features are subject to the users’ Ads Settings, the 
Policy requirements for Google Analytics Advertising 
Features and Google’s EU User Consent policy, which 
requires customers to obtain consent for cookies where 
legally required—including consent for personalized ads. For 
more information about how Google uses advertising 
cookies, visit the Google Advertising Privacy FAQ. It is 
possible to implement Google Analytics without affecting 
normal data collection where Advertising features are 
disabled until consent is obtained. 


IP Address 

Google Analytics uses IP addresses to derive the geolocation 
of a visitor, and to protect the service and provide security to 
our customers. Customers may apply IP masking so that 
Google Analytics uses only a portion of an IP address 








Analytics “to determine a user’s inclusion in an 
experiment and the expiry of experiments a 
user has been included in.”**° 
Analytics “Google Analytics is Google’s analytics tool “It may use a set of cookies to collect information and 
that helps website and app owners to report site usage statistics without personally 
understand how their visitors engage with identifying individual visitors to Google. The main 
their properties” cookie used by Google Analytics is the ‘_ga’ cookie.” °° 
Analytics “to provide the Google Analytics “Identifiers such as cookies and app instance IDs are used to “We use a variety of tools to do this, including Google 


Analytics. When you visit sites that use Google 
Analytics, Google and a Google Analytics customer 
may link information about your activity from that site 
with activity from other sites that use our ad 

services,” 154 


“Google Analytics relies on first-party cookies, which 
means the cookies are set by the Google Analytics 
customer. Using our systems, data generated through 
Google Analytics can be linked by the Google Analytics 
customer and by Google to third-party cookies that 
are related to visits to other websites. For example, an 
advertiser may want to use its Google Analytics data 
to create more relevant ads, or to further analyze its 
traffic.”1°° 





@ brave 


Purported legal basis 





@ brave 





Category 


Purported processing purpose 


Other discoverable processing purposes 


Data collected 


Data shared externally 


Explanation and examples Purported legal basis 














collected, rather than the entire address. In addition, 
customers can override IPs at will using our IP Override 
feature.” 





“helps us provide features like automatic 


product updates...” 158 


“provide features like...”°’ is vague language 
that may conflate or omit many distinct processing 
purposes. 


“information about the apps, browsers, and devices you use 
to access Google services. ... The information we collect 
includes unique identifiers, browser type and settings, device 
type and settings, operating system, mobile network 
information including carrier name and phone number, and 
application version number. We also collect information 
about the interaction of your apps, browsers, and devices 
with our services, including IP address, crash reports, system 
activity, and the date, time, and referrer URL of your 
request. 

We collect this information when a Google service on your 
device contacts our servers — for example, when you install 
an app from the Play Store or when a service checks for 
automatic updates. If you’re using an Android device with 
Google apps, your device periodically contacts Google 
servers to provide information about your device and 
connection to our services. This information includes things 
like your device type, carrier name, crash reports, and which 
apps you’ve installed.” *® 


“For example, we can use information from your 
devices to help you decide which device you’d like to 
use to install an app or view a movie you buy from 
Google Play.”1°° 





“helps us provide features like ... dimming 
your screen if your battery runs low” 


“provide features like...”* is vague language 
that may conflate or omit many distinct processing 
purposes. 


“information about the apps, browsers, and devices you use 
to access Google services. ... The information we collect 
includes unique identifiers, browser type and settings, device 
type and settings, operating system, mobile network 
information including carrier name and phone number, and 
application version number. We also collect information 
about the interaction of your apps, browsers, and devices 
with our services, including IP address, crash reports, system 
activity, and the date, time, and referrer URL of your 
request. 

We collect this information when a Google service on your 
device contacts our servers — for example, when you install 
an app from the Play Store or when a service checks for 
automatic updates. If you’re using an Android device with 
Google apps, your device periodically contacts Google 
servers to provide information about your device and 
connection to our services. This information includes things 
like your device type, carrier name, crash reports, and which 
apps you’ve installed.” 152 


“For example, we can use information from your 
devices to help you decide which device you'd like to 
use to install an app or view a movie you buy from 
Google Play.”° 





“Temporary log data is used only for security and 
stability purposes. This data is used to identify 
and mitigate security threats and/or to fix, 


maintain, or improve Google DNS services.” 15t 


“Google Public DNS, is opt-in for Chrome users. Google 
retains two types of data from Google Public DNS queries, 
temporary logs and permanent logs: Temporary logs contain 
some personal information and are deleted after 48 

hours.” 155 








“Google uses the information shared by sites 
and apps to... protect against fraud and 


abuse”1° 


This vague language may conflate or omit many 
distinct processing purposes. 


“For example, when you visit a website that uses advertising 
services like AdSense, including analytics tools like Google 
Analytics, or embeds video content from YouTube, your web 
browser automatically sends certain information to Google. 
This includes the URL of the page you’re visiting and your IP 
address. We may also set cookies on your browser or read 
cookies that are already there. Apps that use Google 
advertising services also share information with Google, 
such as the name of the app and a unique identifier for 
advertising” .1°” 


Appears to be “legitimate 
interest”, listed as 
“Detecting, preventing, or 
otherwise addressing 
fraud, abuse, security, or 
technical issues with our 
services” 16° 














“to help protect your account. 


"169 





This vague language may conflate or omit many 
distinct processing purposes. 


“information about the apps, browsers, and devices you use 
to access Google services. ... The information we collect 
includes unique identifiers, browser type and settings, device 
type and settings, operating system, mobile network 
information including carrier name and phone number, and 
application version number. We also collect information 
about the interaction of your apps, browsers, and devices 





with our services, including IP address, crash reports, system 
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activity, and the date, time, and referrer URL of your 
request. 

We collect this information when a Google service on your 
device contacts our servers — for example, when you install 
an app from the Play Store or when a service checks for 
automatic updates. If you’re using an Android device with 
Google apps, your device periodically contacts Google 
servers to provide information about your device and 
connection to our services. This information includes things 
like your device type, carrier name, crash reports, and which 
apps you’ve installed.” ° 









“Detect, prevent, or otherwise address fraud, 
security, or technical issues.” 1! 


This vague language may conflate or omit many 
distinct processing purposes. 









“to protect against automated abuse. ... such 
as... stealing money from advertisers by 
fraudulently clicking on ads ...” Y? 


“such as...” 17? is vague language that may 
conflate or omit many distinct processing 
purposes. 


“Collecting and analyzing IP addresses and cookie”!”* 


“Ad fraud information is “retained for extended time 
periods”*’> 


“Unique identifiers can be used for... security and fraud 
detection”*”® 


“This abuse takes many forms, such as sending spam 
to Gmail users, stealing money from advertisers by 
fraudulently clicking on ads, or censoring content by 
launching a Distributed Denial of Service (DDoS) 
attack.” 17 





“to protect against automated abuse. ... such 
as... censoring content by launching a 
Distributed Denial of Service (DDoS) 
attack,”178 






“such as...”"7° is vague language that may 
conflate or omit many distinct processing 
purposes. 


“Collecting and analyzing IP addresses and cookie”? 


“Ad fraud information is “retained for extended time 
periods”?8! 


“Unique identifiers can be used for... security and fraud 
detection”! 


“This abuse takes many forms, such as sending spam 
to Gmail users, stealing money from advertisers by 
fraudulently clicking on ads, or censoring content by 
launching a Distributed Denial of Service (DDoS) 
attack.” 18 









“help you find out if and when someone 
accessed your email without your 
knowledge.” 


“information about recent activity in Gmail, such as the IP 
addresses that accessed your mail, the associated location, 
and the date and time of access.” 185 


“Unique identifiers can be used for... security and fraud 
detection”!85 


“The “last account activity” feature in Gmail” 187 










“Security. ... We use security cookies to... 
protect user data from unauthorized parties. 
... such as attempts to steal the content of 
forms that you complete on web pages.” 188 


“For example, we use cookies called ‘SID’ and ‘HSID’ 
which contain digitally signed and encrypted records 
of a user’s Google account ID and most recent sign-in 
time. The combination of these two cookies allows us 
to block many types of attack, such as attempts to 
steal the content of forms that you complete on web 
pages.”1®° 








“Protect Google, our users, and the public. ... 
This includes detecting, preventing, and 
responding to fraud, abuse, security risks, 
and technical issues that could harm 
Google...”1°° 






“We may also collect information about you from... security 
partners who provide us with information to protect against 
abuse.”**" 


“Other partners help 
Google with securing our 
services; information about 
security threats can help us 
notify you if we think your 
account has been 
compromised (at which 
point we can help you take 
steps to protect your 
account).” 19 


Appears to be legitimate 
interest, described as 
“Protecting against harm 
to the rights, property or 
safety of Google, our 
users, or the public as 
required or permitted by 
law, including disclosing 
information to 


government 


authorities” 1°? 
















“Protect against harm to the rights, property 
or safety of Google, our users, or the public 
as required or permitted by law.” 1° 


This vague language may conflate or omit many 
distinct processing purposes. 












“Protect Google, our users, and the public. ... 
This includes detecting, preventing, and 
responding to fraud, abuse, security risks, 
and technical issues that could harm... the 
public.” 








“We may also collect information about you from... security 
partners who provide us with information to protect against 
abuse.”*°° 





“Other partners help 
Google with securing our 
services; information about 
security threats can help us 
notify you if we think your 
account has been 
compromised (at which 
point we can help you take 
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steps to protect your 
account).” 19 





“Protect against harm to the rights, property 
or safety of Google, our users, or the public 
as required or permitted by law.” 1°8 









“Protect Google, our users, and the public. ... 
This includes detecting, preventing, and 
responding to fraud, abuse, security risks, 
and technical issues that could harm... our 
users...” 199 






“We may also collect information about you from... security 
partners who provide us with information to protect against 
abuse.”? 


“Other partners help 
Google with securing our 
services; information about 
security threats can help us 
notify you if we think your 
account has been 
compromised (at which 
point we can help you take 
steps to protect your 
account).”201 










“Protect against harm to the rights, property 
or safety of Google, our users, or the public 
as required or permitted by law.” 7°? 










“to protect against automated abuse. ... such 
as sending spam to Gmail users ...”?° 


“such as...”? is vague language that may 
conflate or omit many distinct processing 
purposes. 


“Collecting and analyzing IP addresses and cookie”*™> 


Ad fraud information is “retained for extended time 
periods” 


“Unique identifiers can be used for... security and fraud 
detection””” 


“This abuse takes many forms, such as sending spam 
to Gmail users, stealing money from advertisers by 
fraudulently clicking on ads, or censoring content by 
launching a Distributed Denial of Service (DDoS) 
attack.”208 








“to help us detect abuse such as... 
malware...”?°° 


“such as...”?"° is vague language that may 
conflate or omit many distinct processing 
purposes. 


“we analyze your content”?"" 


“Unique identifiers can be used for... security and fraud 
detection’?*? 


“When we detect spam, malware, illegal content, and 
other forms of abuse on our systems in violation of our 
policies, we may disable your account or take other 
appropriate action. In certain circumstances, we may 
also report the violation to appropriate authorities.”*° 





“to help us detect abuse such as spam...”2"* 





“such as...”?1° is vague language that may 
conflate or omit many distinct processing 
purposes. 


“we analyze your content”?"® 


“Unique identifiers can be used for... security and fraud 
detection”! 


“When we detect spam, malware, illegal content, and 
other forms of abuse on our systems in violation of our 
policies, we may disable your account or take other 
appropriate action. In certain circumstances, we may 
also report the violation to appropriate authorities.”?!8 





“Enforce applicable Terms of Service, 
including investigation of potential 
violations.”?1° 




















“When Safe Browsing is enabled in Chrome, 
Chrome contacts Google’s servers 
periodically to download the most recent 
Safe Browsing list of unsafe sites including 
sites associated with phishing, social 
engineering, malware, unwanted software, 
malicious ads, intrusive ads, and abusive 
websites or Chrome extensions.” ?? 








“If you navigate to a URL that appears on the list, Chrome 
sends a partial URL fingerprint (the first 32 bits of a SHA-256 
hash of the URL) to Google for verification that the URL is 
indeed dangerous. Chrome also sends a partial URL 
fingerprint when a site requests a potentially dangerous 
permission, so that Google can protect you if the site is 
malicious. Google cannot determine the actual URL from this 
information. ... In addition to the URL check described 
above, Chrome also conducts client-side checks. If a website 
looks suspicious, Chrome sends a subset of likely phishing 
and social engineering terms found on the page to Google, 
in order to determine whether the website should be 
considered malicious. Chrome can also help protect you from 
phishing if you type one of your previously saved passwords 
into an uncommon site. In this case Chrome sends the URL 
and referrers of the page to Google to see if the page might 
be trying to steal your password. ... For... unverified 
potentially dangerous file downloads, Chrome sends Google 
the information needed to help determine whether the 
download is harmful, including some or all of the following: 
information about the full URL of the site or file download, 
all related referrers and redirects, code signing certificates, 
file hashes, and file header information. ... Google logs the 
transferred data in its raw form and retains this data for up 
to 30 days. Google collects standard log information for Safe 
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Browsing requests, including an IP address and one or more 
cookies. After at most 30 days, Safe Browsing deletes the 
raw logs, storing only calculated data in an anonymized 
form that does not include your IP addresses or cookies. 
Additionally, Safe Browsing requests won’t be associated 
with your Google Account. They are, however, tied to the 
other Safe Browsing requests made from the same 





device.”?*1 
“You can also opt in to reporting additional “If you opt in, Chrome will send an incident report to Google 
data relevant to security to help improve every time you receive a warning, visit a suspicious page, 
Safe Browsing and security on the and ona very small fraction of sites where Chrome thinks 
Internet.” ?22 there could be threats, to help Safe Browsing learn about 


the new threats you may be encountering. The reports... 
can include URLs, headers, and snippets of content from the 
page ... If Chrome discovers unwanted or malicious software 
on your machine, the reports may also include details about 
malicious files and registry entries. ... Chrome also sends a 
request to Safe Browsing each time you start to enter a 
password on a page that isn’t in Chrome’s local list. In 
addition, the request Chrome sends to Safe Browsing to 
determine the reputation of the website on which you reuse 
your password includes the list of websites for which you 
saved this password in Chrome’s password manager (but 
not the password itself). ... Google logs the transferred data 
in its raw form and retains this data for up to 30 days. 
Google collects standard log information for Safe Browsing 
requests, including an IP address and one or more cookies. 
After at most 30 days, Safe Browsing deletes the raw logs, 
storing only calculated data in an anonymized form that 
does not include your IP addresses or cookies. Additionally, 
Safe Browsing requests won’t be associated with your 
Google Account. They are, however, tied to the other Safe 
Browsing requests made from the same device.”??? 





“to improve the quality of download “Chrome may ask you to opt in to reporting to Google Safe 
protection’? Browsing some data relevant to security ... Once you’ve 
opted in, some downloaded files that are suspicious will be 
sent to Google for investigation each time they are 
encountered.””*° 





“improving Google’s ability to detect “System information includes metadata about programs 
unwanted software...” ?5 installed or running on your system that could be associated 
with harmful software, such as: services and processes, 
scheduled tasks, system registry values commonly used by 
malicious software, command-line arguments of Chrome 
shortcuts, Windows proxy settings, and software modules 
loaded into Chrome or the network stack. ... stored for up to 
14 days, after which only aggregated statistics are 
retained.”?2’ 








Chrome “to determine the aggregate popularityand | This vague language may conflate or omit many “information (such as the application ID, when the 
usage of applications and extensions”? distinct processing purposes. application was last used, and how long it’s been 
installed).”22° 





Chrome “to keep you up to date with the latest and “information necessary for the update process, such as the 
most secure versions”??? version of Chrome, its release channel, basic hardware 
information, and update errors that have been encountered. 
The update requests also send Google information that 
helps us understand how many people are using Google 
Chrome and the Chrome Apps Launcher —specifically, 
whether the software was used in the last day, the number 
of days since the last time it was used, the total number of 
days it has been installed, and the number of active profiles. 
Google Update also periodically sends a non-unique four- 
letter tag that contains information about how you obtained 
Google Chrome. This tag is not personally identifiable, does 
not encode any information about when you obtained 
Google Chrome, and is the same as everyone who obtained 
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Google Chrome the same way. Because Chrome OS updates 
the entire OS stack, Google Update on Chrome OS also sends 
the current Chrome OS version and hardware model 
information to Google ... This information is not personally 
identifiable, and is common to all users of Chrome OS on the 
same revision of device. ... If you install web apps on an 
Android device, a Google server is responsible for creating a 
native Android package that can be verified for authenticity 
by Chrome. When Chrome is updated or notices that the 
web app’s manifest has changed, Chrome asks the server for 
a new version of the Android package in a cookieless 
request. If the information needed to create the native 
Android package cannot be acquired by the server (e.g., 
because the information is behind a corporate firewall), 
Chrome sends it to Google and an Android package is 
created that is unique to you. It contains a unique and 
random identifier that is not tied to your identity.” ?? 





“Google Chrome can show tips to help guide 
you to the page you were trying to reach in 
cases where the web address cannot be 
found, a connection cannot be made, the 
server returns a very short (under 512 byte) 


error message, or you’ve navigated toa 
1232 





parked domain. 


“Google Chrome will first check the address against a 
locally-stored list of suspected parked domains. If there is a 
match, Chrome sends a partial fingerprint (a hash prefix) of 
the URL to Google for verification that the domain is indeed 
parked. ... In the case of other navigation errors, the URL of 
the web page you’re trying to reach is stripped of all GET 
parameters, and then sent to Google in order to retrieve 
navigation tips. This information is logged and anonymized 
in the same manner as Google web searches. The logs are 
used to ensure and improve the quality of the feature. ... 
when a domain name cannot be found, Chrome will 
investigate the underlying cause by attempting to resolve 
“google.com” using both Google Public DNS and the default 
DNS service configured for your system. ... In the event that 
Chrome detects SSL connection timeouts, certificate errors, 
or other network issues that might be caused by a captive 
portal (a hotel’s WiFi network, for instance), Chrome will 
make a cookieless request to 
https://www.gstatic.com/generate_204 and check the 
response code. If that request is redirected, Chrome will 
open the redirect target in a new tab on the assumption that 
it’s a login page. Requests to the captive portal detection 
page are not logged.”*** 





“to measure installations or reactivations 
of Chrome through a campaign...” ?* 


“Chrome will send a token or an identifier unique to your 
device to Google at the first launch of Chrome, as well as the 
first search using Google. On desktop versions of Chrome, a 
token unique to your device is generated. The same token 
will be sent if Chrome is later reinstalled at first launch and 
at first use of the Omnibox after reinstallation or 
reactivation. Rather than storing the token on the computer, 
it is generated when necessary by using built-in system 
information that is scrambled in an irreversible manner. On 
iOS, Chrome uses the IDFA for counting installations 
acquired by a campaign, and it can be reset in iOS 
settings.”73 





“in order to help improve Chrome’s feature 
set and stability.”2°° 


“information such as system information, preferences, 
user interface feature usage, responsiveness, performance, 
and memory usage. Crash reports contain system 
information gathered at the time of the crash, and may 
contain web page URLs or personal information depending 
on what was happening at the time of the crash. ... Chrome 
stores a randomly generated unique token on your device, 
which is sent to Google along with your usage statistics and 
crash reports.”?2” 





“Desktop versions of Chrome can provide 
smarter spell-checking...”?3® 








“,.Chrome sends the entire contents of text fields as you 
type in them to Google, along with the browser’s default 
language.””39 
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Contacts 





“Communicate with you. ... send you a 
notification if we detect suspicious activity, 
like an attempt to sign in to your Google 
Account from an unusual location. Or we 
may let you know about upcoming changes 
or improvements to our services.**+ 


“We use information we collect, like your email address, to 
interact with you directly.” *42 





“Communicate with you. ... we may let you 
know about upcoming changes or 
improvements to our services.” 2“? 


“We use information we collect, like your email address, to 
interact with you directly.”*“* 


This appears to be 
“legitimate interest”. 
Google says it uses 
legitimate interest as its 
legal basis for “Marketing 
to inform users about our 
services” 4° 





“Provide our services. ... helping you share 
content by suggesting recipients from your 
contacts.”2"° 





“Google’s Crisis Response products are 
designed to inform you about emergencies 
and other extreme events. Your reports are 
used to help others affected by these 
crises.”247 





Customer support 


“Communicate with you. ... if you contact 
Google, we’ll keep a record of your request in 
order to help solve any issues you might be 
facing.” 


“We use information we collect, like your email address, to 
interact with you directly.”*“° 





Customer support 


“Provide our services. ... to provide support in 
connection with the product or service you 
purchase.”*°° 


“When you purchase services or physical goods from us, you 
may provide us information like your shipping address or 
delivery instructions.” > 





Detect illegal content 


“to help us detect abuse such as... illegal 
content”? 


“Such as...”?? is vague language that may 


conflate or omit many distinct processing 
purposes. 


“we analyze your content”? 


“Unique identifiers can be used for... security and fraud 
detection’”?>> 


“When we detect spam, malware, illegal content, and 
other forms of abuse on our systems in violation of our 
policies, we may disable your account or take other 
appropriate action. In certain circumstances, we may 
also report the violation to appropriate authorities.”?° 





Email product 


“helps people identify an email coming from 
yo u” 257 


“If other users already have your email address or 
other information that identifies you, we may show 
them your publicly visible Google Account information, 
such as your name and photo.”?58 





Email product 


“Provide our services. ... A flight confirmation 
email you receive may be used to create a 
“check-in” button that appears in your 
Gmail.”?°° 


This vague language may conflate or omit many 
distinct processing purposes. 





Email product 


“syncing services such as your email inbox’?® 


“..such as...”?5" is vague language that may 
conflate or omit many distinct processing 
purposes. 


“Unique identifiers”? 











Email product 





“To ensure continuity of service for you and 
other users.” ?® 


“For example, when you share information with other 
users (such as when you have sent an email to 
someone else), deleting it from your Google Account 
will not eliminate copies maintained by the 
recipients.”?54 





“Provide our services. ... use the IP address 
assigned to your device to send you the data 
you requested, such as loading a YouTube 
video.”265 
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Purported processing purpose 


Other discoverable processing purposes 
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Explanation and examples Purported legal basis 








Essential session cookies 


“Process cookies help make the website work 
and deliver services that the website visitor 
expects, like navigating around web pages or 
accessing secure areas of the website. 
Without these cookies, the website cannot 
function properly.”2° 


“For example, we use a cookie called ‘Ibcs’ which 
makes it possible for Google Docs to open many Docs 
in one browser. Blocking this cookie would prevent 
Google Docs from operating correctly.”*°" 





Essential session cookies 


uu 


‘session state cookies’ to help us improve 
our services, in order to improve our users’ 
browsing experience.”?° 


“Websites often collect information about how users 
interact with a website. This may include the pages 
users visit most often and whether users get error 
messages from certain pages.”?°° 








n272 


spelling ... 


|Gboard product | “Your Gboard learned words help ... to “When Sync learned words is turned on for a device, your 
predict searches that you might be interested learned words are saved to your Google Account to use 
fin.” across devices.” ”! 

|Gboard product | “Your Gboard learned words help you with “When Sync learned words is turned on for a device, your 


learned words are saved to your Google Account to use 
across devices.” 273 

















Government compliance 


“Meet any applicable law, regulation, legal 
process, or enforceable governmental 
request.”274 





Location 


“showing you when a restaurant is typically 
busy”2”5 


“GPS, IP address, Sensor data from your device, Information 
about things near your device’?”° 


“your device sends information to Google about its location, 
sensors (like accelerometer), and nearby cell towers and Wi- 
Fi access points (like MAC address and signal strength).”*”” 


Also see further related detail at 
https://policies.google.com/technologies/location-data#how- 
find 





Location 


“To help improve Location History”?”® 


This vague language may conflate or omit many 
distinct processing purposes. 


“For example, sent information could include: 

Quality and length of your connections to mobile networks, 
GPS, Wi-Fi networks, or Bluetooth. State of your location 
settings. Restarts and crash reports. Apps used to turn 
Location History on or off. Battery levels”? 





Location 


“This data helps Google give you more 
personalised experiences across Google 
services, such as ... tips about your commute 
... both on and off Google.”®° 


“such as...”"* is vague language that may 
conflate or omit many distinct processing 
purposes. 


“Location History saves where you go with your devices. To 
save this data, Google regularly obtains location data from 
your devices. This data is saved even when you aren’t using 
a specific Google service, such as Google Maps or Search. ... 
This data may be saved and used in any Google service 
where you are signed in to give you more personalised 
experiences.”?°? 


“both on and off Google” 
is vague language that may 
indicate extensive or minor 
data sharing with an 
unknowable number 


Google’s business partners. 
283 





Location 


“How Google Maps gets you places faster’ ?** 


“When you use the Google Maps app, your phone sends 
anonymous bits of data about your location back to 
Google”? 


“For instance, Maps can detect when a lot of vehicles Unknown 
are moving slowly along the same street and let you 


know there is heavy traffic.” ?8 


If these data are actually 
not personal data, then a 
legal basis is not required. 





Location 


“making sure your search results include 
things near you”?®” 


This vague language may conflate or omit many 
distinct processing purposes. 


“GPS, IP address, Sensor data from your device, Information 
about things near your device”?®® 


“your device sends information to Google about its location, 
sensors (like accelerometer), and nearby cell towers and Wi- 
Fi access points (like MAC address and signal strength).”*°° 


Also see further related detail at 
https://policies.google.com/technologies/location-data#how- 
find 








Location 











“helps us offer features like driving directions 
for your weekend getaway...”*°° 











“offer features like...’?°" is vague language that 
may conflate or omit many distinct processing 
purposes. 





“GPS, IP address, Sensor data from your device, Information 
about things near your device”??? 


“your device sends information to Google about its location, 
sensors (like accelerometer), and nearby cell towers and Wi- 
Fi access points (like MAC address and signal strength).”?°° 
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Category Purported processing purpose Other discoverable processing purposes Data collected Data shared externally Explanation and examples 
Also see further related detail at 
https://policies.google.com/technologies/location-data#how- 
find 
Location “to provide improved ... commute routes, and |“...and more”?®> may cover many purposes. “Location History creates a private map of where you go “This gives you improved map searches and commute 
more.”?°4 with your signed-in phones”? routes, as well as helping you to rediscover the places 
you’ve been and the routes you've travelled”?” 
Location “provides more personalized experiences “If you opt in to Location History and your device is reporting 
across Google ... real-time information about location, the precise location of your signed-in devices will 
the best time to leave for home or work in be collected and stored, even when you’re not actively using 
order to beat the traffic...” 98 a Google product or service.” *°° 
Location “to provide improved map searches...” 300 “Location History creates a private map of where you go “This gives you improved map searches and commute 
with your signed-in phones’?™ routes, as well as helping you to rediscover the places 
you’ve been and the routes you’ve travelled”??? 
Location “helps us offer features like ... showtimes for |“...offer features like...”2 is vague language that | “GPS, IP address, Sensor data from your device, Information 
movies playing near you.”*°? may conflate or omit many distinct processing about things near your device”*°° 
purposes. 
“your device sends information to Google about its location, 
sensors (like accelerometer), and nearby cell towers and Wi- 
Fi access points (like MAC address and signal strength).”?°° 
Also see further related detail at 
https://policies.google.com/technologies/location- 
data#thow-find 
Location “This data helps Google give you more “such as...” is vague language that may “Location History saves where you go with your devices. To | “...both on and off Google” 
personalised experiences across Google conflate or omit many distinct processing save this data, Google regularly obtains location data from is vague language that may 
services, such as a map of where you’ve purposes. your devices. This data is saved even when you aren’t using indicate extensive or minor 
been... both on and off Google.”?” a specific Google service, such as Google Maps or Search. ... data sharing with an 
This data may be saved and used in any Google service unknowable number 
where you are signed in to give you more personalised Google’s business 
experiences”? partners.310 
Location “provides more personalized experiences “If you opt in to Location History and your device is reporting 
across Google ... albums in Google Photos location, the precise location of your signed-in devices will 
automatically created from places you’ve be collected and stored, even when you’re not actively using 
visited.” 311 a Google product or service.” °! 
Location “Albums in Google Photos automatically “your Location History”>* 
created from places you’ve visited”?! 
Location “This helps create your Timeline where “If you opt in to Location History and your device is reporting 
Location History data is stored”?! location, the precise location of your signed-in devices will 
be collected and stored, even when you’re not actively using 
a Google product or service.” 315 
Location “Real-time information about the best time “your Location History”**® 


to leave for home or work in order to beat 
the traffic?’ 





Maintain and improve 
services 





“Google uses the information shared by sites 
and apps to... maintain and improve ... our 
services...” ?19 





This vague language may conflate or omit many 
distinct processing purposes. 





“For example, when you visit a website that uses advertising 
services like AdSense, including analytics tools like Google 
Analytics, or embeds video content from YouTube, your web 











Purported legal basis 
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Category 


Purported processing purpose 


Other discoverable processing purposes 


Data collected 


Data shared externally 


Explanation and examples Purported legal basis 








browser automatically sends certain information to Google. 
This includes the URL of the page you’re visiting and your IP 
address. We may also set cookies on your browser or read 
cookies that are already there. Apps that use Google 
advertising services also share information with Google, 
such as the name of the app and a unique identifier for 
advertising.”??° 





Maintain and improve 
services 


“Maintain & improve our services. ... to make 
improvements to our services.” ?? 


This vague language may conflate or omit many 
distinct processing purposes. 


“for example, understanding which search terms are 
most frequently misspelled helps us improve spell- 


check features used across our services” °? 


“For example, we use cookies to analyze how people 
interact with our services. And that analysis can help 
us build better products. For example, it may help us 
discover that it’s taking people too long to complete a 
certain task or that they have trouble finishing steps at 
all. We can then redesign that feature and improve 
the product for everyone.”?** 





Maintain services: 
troubleshoot 


“Maintain & improve our services. ... to 
ensure our services are working as intended, 
such as tracking outages or troubleshooting 
issues that you report to us.” ?® 


“For example, we continuously monitor our systems to 
look for problems. And if we find something wrong 
with a specific feature, reviewing activity information 
collected before the problem started allows us to fix 
things more quickly.”>2’ 





Personalisation & 
recommendations 


“to improve Chrome’s understanding of the 
languages you speak and when Chrome 
should offer to translate text for you.” >? 


“If you’ve chosen to sync your Chrome history, statistics 
about the languages of pages you visit and about your 
interactions with the translation feature will be sent to 
Google...”329 





Personalisation & 
recommendations 


“automatic descriptions for users who are 
visually impaired...” °° 


“by sending the contents of images on pages you visit to 
Google’s servers.” 331 





Personalisation & 
recommendations 


“Google also uses your synchronized 
browsing data to provide personalized 
Google products and services to you.”>*° 


This vague language may conflate or omit many 
distinct processing purposes. 





Personalisation & 
recommendations 


“How Chrome Auto-fill completes forms for 
you” 335 


“When you use Chrome, we can save things like your name, 

address, phone number, email address and payment 

information so that we can auto-complete these forms for 
336 

you. 





Personalisation & 
recommendations 





“If you’ve chosen to sync your Chrome 
history, and if Google is your default search 
engine, the URL of the page you’re viewing is 
sent to Google in order to provide better, 
contextually relevant suggestions.”>>’ 





This vague language may conflate or omit many 
distinct processing purposes. 





“URLs are sent only for HTTP pages and HTTPS pages, not 
other schemes such as file: and ftp:”?** 
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Category 


Purported processing purpose 


Other discoverable processing purposes 


Data collected 


Data shared externally 


Explanation and examples 








Personalisation & 
recommendations 


“display suggestions for websites that you 
might want to visit. ... Chrome may suggest 
content that is popular in your country or 
region. ... Chrome tries to make personalized 
suggestions that are useful to you.”>"° 


This vague language may conflate or omit many 
distinct processing purposes. 


“Chrome uses your IP address to identify your country or 
region. ... Chrome uses the sites you have visited from your 
local browsing history. ... If you are signed into Chrome, 
suggestions are also based on data stored in your Google 
account activity.” ° 





Personalisation & 
recommendations 


“Chrome measures the quality of suggestions 
by sending Google information about the sets 
of suggestions that were displayed, and 
those that were selected.” >“? 


This vague language may conflate or omit many 
distinct processing purposes. 


“information about the sets of suggestions that were 
displayed, and those that were selected.” *** 





Personalisation & 
recommendations 


“For Chrome on Android, in certain countries, 
Chrome may download the content of the 
New Tab page suggestions from Google, for 
use while offline.”?“* 


“Chrome sends to Google a cookieless request with the URL 
for each suggestion, along with Chrome’s user agent string, 
in order to render the content.” *° 





Personalisation & 
recommendations 


“Customizing our services to provide you with 
a better user experience”*“* 


This vague language may conflate or omit many 
distinct processing purposes. 


“For example, we may display a Google Doodle on the 
Search homepage to celebrate an event specific to 


your country.”*“7 





Personalisation & 
recommendations 


“Google uses the information shared by sites 
and apps to ... personalize content... you see 
on Google ...”3"8 


This vague language may conflate or omit many 
distinct processing purposes. 


“For example, when you visit a website that uses advertising 
services like AdSense, including analytics tools like Google 
Analytics, or embeds video content from YouTube, your web 
browser automatically sends certain information to Google. 
This includes the URL of the page you’re visiting and your IP 
address. We may also set cookies on your browser or read 
cookies that are already there. Apps that use Google 
advertising services also share information with Google, 
such as the name of the app and a unique identifier for 
advertising.”*“° 





Personalisation & 
recommendations 


“Google uses the information shared by sites 
and apps to ... personalize content... you see 
n ... our partners’ sites and apps.”2°° 


This vague language may conflate or omit many 
distinct processing purposes. 


“For example, when you visit a website that uses advertising 
services like AdSense, including analytics tools like Google 
Analytics, or embeds video content from YouTube, your web 
browser automatically sends certain information to Google. 
This includes the URL of the page you’re visiting and your IP 
address. We may also set cookies on your browser or read 
cookies that are already there. Apps that use Google 
advertising services also share information with Google, 
such as the name of the app and a unique identifier for 
advertising.”*>+ 





Personalisation & 
recommendations 


“Provide personalised services, including 
content and ads. ... to customize our services 
for you, including providing ... personalized 
content...” 35? 


This vague language may conflate or omit many 
distinct processing purposes. 





Personalisation & 
recommendations 


“helps Google give you more personalised 
experiences across Google services, such as ... 
content recommendations ... both on and off 
Google.”?5? 


“Such as...”2°4 is vague language that may 
conflate or omit many distinct processing 
purposes. 


“Additional Web & App Activity saves your activity from 
sites, apps and devices that use Google services, including: 
activity from sites and apps that partner with Google to 
show ads 

Chrome history (if Chrome Sync is turned on) 

app activity, including data that apps share with Google 
Android usage & diagnostics, such as battery level, how 
often you use your device and apps, and system errors 

.. This data may be saved and used in any Google service 
where you are signed in...” ?55 


“both on and off Google” 
is vague language that may 
indicate extensive or minor 
data sharing with an 
unknowable number 
Google’s business 
partners.3°¢ 





Personalisation & 
recommendations 


“This data helps Google give to you more 
personalised experiences across Google 
services, like ... suggesting creators that you 
might like ... both on and off Google.”°” 


“wlike...”°> is vague language that may conflate or 
omit many distinct processing purposes. 


“YouTube History saves the YouTube videos that you watch 
and listen to and the things that you search for on YouTube. 
.. This data may be saved and used in any Google service 
where you are signed in to give you more personalised 
experiences.”*°° 


“both on and off Google” 
is vague language that may 
indicate extensive or minor 
data sharing with an 
unknowable number 
Google’s business 
partners.3© 








Personalisation & 
recommendations 





“This data helps Google give you more 
personalised experiences across Google 
services, such as recommendations for 





“such as...”2° is vague language that may 
conflate or omit many distinct processing 
purposes. 





“YouTube search history saves your YouTube searches. ... 
This data may be saved and used in any Google service 








“both on and off Google” 
is vague language that may 
indicate extensive or minor 
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Purported processing purpose 


Other discoverable processing purposes 


Data collected 


Data shared externally 


Explanation and examples 


Purported legal basis 





content or creators that you'll like ... both on 
and off Google.”** 


where you are signed in to give you more personalised 
experiences.”3°3 


data sharing with an 
unknowable number 
Google’s business 
partners.?6t 





Personalisation & 
recommendations 


“This data helps Google give you more 
personalised experiences across Google 
services, such as... seeing recommendations 
for content that you'll like ... both on and off 
Google.”?55 


“Such as...”2°° is vague language that may 
conflate or omit many distinct processing 
purposes. 


“YouTube watch history saves the YouTube videos you 
watch and listen to. ... This data may be saved and used in 
any Google service where you are signed in to give you more 
personalised experiences.”**’ 


“both on and off Google” 
is vague language that may 
indicate extensive or minor 
data sharing with an 
unknowable number 
Google’s business 
partners.268 





Personalisation & 
recommendations 


“helps Google give you more personalised 
experiences across Google services. For 
example, discovering new apps, films and 
music that you'll enjoy.” >° 


This vague language may conflate or omit many 
distinct processing purposes. 


“Your Google Play library activity, such as purchases, 
subscriptions and downloads,..”?”° 





Advertising (related to 
targeting) 


“Some ways Google uses your birthday. ... 
Determine your age group for personalized 
recommendations...”27+ 


“some ways...” and “...personalized 
recommendations...” is vague language that may 
conflate or omit many distinct processing 
purposes.?”2 





Personalisation & 
recommendations 


“After you link a subscription to your 
account, Google can personalize experiences 
like: 

Finding articles without signing in to an 
account or hitting a paywall. 

Getting articles from print subscriptions in 
your search results.”>7* 


This vague language may conflate or omit many 
distinct processing purposes. 


“Manage linked subscriptions 

Subscriptions can include content like: 

Google Play subscriptions 

YouTube subscriptions 

News subscriptions you’ve linked with your Google 
Account”? 





Personalisation & 
recommendations 


“to do things like recommend a YouTube 
video you might like’?”> 


“do things like...”°’° is vague language that may 
conflate or omit many distinct processing 
purposes. 


“The activity information we collect may include: 

Terms you search for 

Videos you watch 

Views and interactions with content and ads 

Voice and audio information when you use audio features 
Purchase activity 

People with whom you communicate or share content 
Activity on third-party sites and apps that use our services 
Chrome browsing history you’ve synced with your Google 
Account 

If you use our services to make and receive calls or send and 
receive messages, we may collect telephony log information 
like your phone number, calling-party number, receiving- 
party number, forwarding numbers, time and date of calls 
and messages, duration of calls, routing information, and 
types of calls.” 37 





Personalisation & 
recommendations 


“Your ‘Not interested’ feedback is used to 
remove videos from your YouTube 
recommendations.”37® 


“The following recommended content can be removed from 
the Home page on your computer: 

Videos 

Channels 

Sections 

Playlists 

You can also remove recommended videos from the Watch 
Next page on your computer’?”° 





Personalisation & 
recommendations 


“help Google deliver the best possible News 
experience and signal other Google services 
about your preferences. “?*° 


This vague language may conflate or omit many 
distinct processing purposes. 


“Your preferences about News ....” 381 








Personalisation & 
recommendations 


“Provide personalised services, including 
content and ads. ... to customize our services 
for you, including providing 
recommendations...” ?8? 





This vague language may conflate or omit many 
distinct processing purposes. 
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Explanation and examples 








Personalisation & 
recommendations 


“helps Google give you more personalised 
experiences across Google services. For 
example, discovering new products that 
you'll enjoy.”?® 


“to Make recommendations on items to buy. 
Enable quick reorders of products you’ve 
purchased before. Send reminders based on 
your preferences and past orders” *** 


In this context, “...for example...”**° is vague 
language that may conflate or omit many distinct 
processing purposes. 


“Your Google Shopping order activity, such as items that you 
purchase through Buy With Google”?®8 


“To help you get better results on Google Shopping, your 
order history and past Google activity are used” **” 





Personalisation & 
recommendations 


“Your Word Coach answers are used to 
personalise your game experience and show 
words that are more relevant to you.” ?®8 





Personalisation & 
recommendations 


“to ... give you customized experiences in 
Search, Maps, and other Google product”**? 


This vague language may conflate or omit many 
distinct processing purposes. 


“Web & App Activity saves your searches and other activity 
on Google services”??? 





Personalisation & 
recommendations 


“Your “Not Interested” feedback may be used 
to tune your recommendations.”?** 





Personalisation & 
recommendations 


“helps Google give you more personalised 
experiences across Google services, such as 
helpful app ... recommendations ... both on 
and off Google.”??? 


“such as...”*°? is vague language that may 


conflate or omit many distinct processing 
purposes. 


“Additional Web & App Activity saves your activity from 
sites, apps and devices that use Google services, including: 
activity from sites and apps that partner with Google to 
show ads 

Chrome history (if Chrome Sync is turned on) 

app activity, including data that apps share with Google 
Android usage & diagnostics, such as battery level, how 
often you use your device and apps, and system errors 

... This data may be saved and used in any Google service 
where you are signed in...” °% 


“both on and off Google” 
is vague language that may 
indicate extensive or minor 
data sharing with an 
unknowable number 
Google’s business 
partners.3°° 





Personalisation & 
recommendations 


“This data helps Google give you more 
personalised experiences across Google 
services, such as ... recommendations based 
on places that you’ve visited ... both on and 
off Google.” 


“such as...”°” is vague language that may 


conflate or omit many distinct processing 
purposes. 


“Location History saves where you go with your devices. To 
save this data, Google regularly obtains location data from 
your devices. This data is saved even when you aren’t using 
a specific Google service, such as Google Maps or Search. ... 
This data may be saved and used in any Google service 
where you are signed in to give you more personalised 
experiences.” ?’8 


“both on and off Google” 
is vague language that may 
indicate extensive or minor 
data sharing with an 
unknowable number 
Google’s business 
partners.399 





Personalisation & 
recommendations 


“This data helps Google give to you more 
personalised experiences across Google 
services, like giving you better 
recommendations ... both on and off 
Google.” 


“wlike...”*°" is vague language that may conflate or 
omit many distinct processing purposes. 


“YouTube History saves the YouTube videos that you watch 
and listen to and the things that you search for on YouTube. 
.. This data may be saved and used in any Google service 
where you are signed in to give you more personalised 
experiences.” * 


“both on and off Google” 
is vague language that may 
indicate extensive or minor 
data sharing with an 
unknowable number 
Google’s business 
partners.“ 





Personalisation & 
recommendations 


“help ... improve recommendations in 
YouTube and other Google services.” ° 


This vague language may conflate or omit many 
distinct processing purposes. 


“Your YouTube search history” ^5 


“YouTube recommends videos that you may like based on 
what you have watched before and what other people with 
similar viewing histories have watched before.”°° 





Personalisation & 
recommendations 


“YouTube History stores: Your YouTube 
search history to make your future searches 
faster ...”4°7 


This vague language may conflate or omit many 
distinct processing purposes. 





Personalisation & 
recommendations 


“YouTube History stores: Your YouTube 
search history to ... improve your 
recommendations.”*% 


This vague language may conflate or omit many 
distinct processing purposes. 





Personalisation & 
recommendations 


“Your YouTube watch history to make it 
easier for you to find your recently watched 
videos on YouTube...”409 





Personalisation & 
recommendations 


“Your YouTube watch history to ... avoid 
getting recommendations for already 
watched videos...”42° 








Personalisation & 
recommendations 





“Your YouTube watch history to... 
improve your recommendations.”414 





This vague language may conflate or omit many 
distinct processing purposes. 
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Other discoverable processing purposes 
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Personalisation & 
recommendations 


“provides more personalized experiences 
across Google—restaurants suggested in 
Google Maps based on dining spots you’ve 
visited...”412 


This vague language may conflate or omit many 
distinct processing purposes. 


“If you opt in to Location History and your device is reporting 
location, the precise location of your signed-in devices will 
be collected and stored, even when you’re not actively using 
a Google product or service.”*"3 





Personalisation & 
recommendations 


“Recommendations based on places you’ve 
visited’ 


This vague language may conflate or omit many 
distinct processing purposes. 


“your Location History” “5 





Personalisation & 
recommendations 


“remembering your preferences”*'® 


“Unique identifiers”*"’ 





Personalisation & 
recommendations 


“Preferences. ... These cookies allow our 
websites to remember information that 
changes the way the site behaves or looks, 
such as your preferred language or the 
region you are in. For instance, by 
remembering your region, a website may be 
able to provide you with local weather 
reports or traffic news. These cookies can 
also assist you in changing text size, font, and 
other parts of web pages that you can 
personalize.”*18 


“Most Google users will have a preferences cookie 
called ‘NID’ in their browsers. A browser sends this 
cookie with requests to Google’s sites. The NID cookie 
contains a unique ID Google uses to remember your 
preferences and other information, such as your 
preferred language (e.g. English), how many search 
results you wish to have shown per page (e.g. 10 or 
20), and whether or not you wish to have Google’s 
SafeSearch filter turned on.”*19 





Personalisation & 
recommendations 


“This data helps Google give to you more 
personalised experiences across Google 
services, like ... remembering where you left 
off when you resume a video... both on and 
off Google.”*?° 


“.Like...”*24 is vague language that may conflate or 
omit many distinct processing purposes. 


“YouTube History saves the YouTube videos that you watch 
and listen to and the things that you search for on YouTube. 
.. This data may be saved and used in any Google service 
where you are signed in to give you more personalised 
experiences.” ®? 


“both on and off Google” 
is vague language that may 
indicate extensive or minor 
data sharing with an 
unknowable number 
Google’s business 
partners." 





Personalisation & 
recommendations 


“help make your recently watched videos 
easier to find ...”424 


“Your YouTube watch history”*”° 


“to make it easier for you to find your recently 
watched videos on YouTube, avoid getting 
recommendations for already watched videos, and 
improve your recommendations.”*° 





Phone directory 


“to...help people find and connect with 
you...” 


“If you add your phone number to your account” ®?8 





Photos 


“Provide our services. ... Photos and videos 
you upload to Google Photos are used to help 
you create albums, animations, and other 
creations that you can share.”*?9 





p 





“Your Google app podcast subscriptions 
make it easy to find your favourite podcasts 


in the Google app and Google Assistant.”**° 








Search 





“Google Chrome uses a combined web 
address and search bar (we call it the 
“omnibox”) at the top of the browser 
window. As you use the omnibox, your 
default search engine can suggest addresses 
and search queries that may be of interest to 
you. These suggestions make navigation and 
searching faster and easier, and are turned 
on by default...”43" 








“In order to provide these suggestions, Chrome sends the 
text you’ve typed into the omnibox, along with a general 
categorization (e.g., “URL”, “search query”, or “unknown”), 
to your default search engine. Chrome will also send a signal 
to your default search engine when you focus in the 
omnibox, telling it to get ready to provide suggestions. That 
signal includes the URL of the currently displayed search 
engine results page. Your IP address and certain cookies are 
also sent to your default search engine with all requests, in 
order to return the results that are most relevant to you. 

If Chrome determines that your typing may contain 
sensitive information, such as authentication credentials, 
local file names, or URL data that is normally encrypted, it 
will not send the typed text. 

If Google is your default search engine, when you select one 
of the omnibox suggestions, Chrome sends your original 
search query, the suggestion you selected, and the position 
of the suggestion back to Google. This information helps 
improve the quality of the suggestion feature, and it’s 
logged and anonymized in the same manner as Google web 
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Category Purported processing purpose Other discoverable processing purposes Data collected Data shared externally Explanation and examples 
searches. Logs of these suggestion requests are retained for 
two weeks, after which 2% of the log data is randomly 
selected, anonymized, and retained in order to improve the 
suggestion feature.”**? 

Search “If Google is your default search engine, “it’s logged and anonymized in the same manner as Google 
when you select one of the omnibox web searches. Logs of these suggestion requests are 
suggestions, Chrome sends your original retained for two weeks, after which 2% of the log data is 
search query, the suggestion you selected, randomly selected, anonymized, and retained in order to 
and the position of the suggestion back to improve the suggestion feature.”*** 

Google. This information helps improve the 
quality of the suggestion feature”*** 

Search “If Google is set as your default search “In order to do this, Chrome will send a request to “For example, if you were in Germany, your omnibox 
engine, Chrome will try to determine the google.com each time you start the browser. If you already searches may go through google.de instead of 
most appropriate locale for Google search have any cookies from the google.com domain, this request google.com.” 
queries conducted from the omnibox in order will also include these cookies, and is logged as any normal 
to give you relevant search results based on HTTPS request to google.com would be.”*°° 
your location.’”*?° 

Search “to identify recommended search terms (for “If you’ve enabled “Tap to Search” on Chrome Mobile you 
example, tapping on “whale” on a site about can search for terms by tapping them. ... the word, the 
the blue whale would lead to showing “blue surrounding text, and the home country of your device’s SIM 
whale”).”437 card are sent to Google ... The tapped word is logged in 

accordance with standard Google logging policies, and the 
surrounding text and home country are logged only when 
the page is already in Google’s search index.” *®8 

Search “to improve your query suggestions”**° This vague language may conflate or omit many “If you’ve enabled “Tap to Search” on Chrome Mobile you 

distinct processing purposes. can search for terms by tapping them. ... the word, the 
surrounding text, and the home country of your device’s SIM 
card are sent to Google ... The tapped word is logged in 
accordance with standard Google logging policies, and the 
surrounding text and home country are logged only when 
the page is already in Google’s search index. If you have 
turned on “Make searches and browsing better’, the URL of 
the page is also sent and logged, and is used to improve 
your query suggestions.” “®t 

Search “to make searches faster...” %3 This vague language may conflate or omit many “Web & App Activity saves your searches and other activity 

distinct processing purposes. on Google services”*“* 

Search “Google currently measures the quantity of traffic 

it refers to other websites by logging user activity 
like queries and clicks, and then using tools that 
analyze those logs to produce aggregate metrics 
that, in our experience, correlate with user 
satisfaction with Google Search results.” **° 

Search “Provide our services. ... processing the terms “We use automated systems that analyze your content to 
you search for in order to return results”““° provide you with things like customized search results...”“4" 

Search “helps us show you ... more tailored This vague language may conflate or omit many “your searches and activity from a number of other Google 





suggestions—like when you see your search 
automatically suggested based on past 
searches.” “48 





distinct processing purposes. 





services are saved to your Google Account. The activity 
saved to Web & App Activity may also include location 
information... The location used and stored with your Web & 
App Activity can come from signals like the device’s IP 
address, your past activity, or from your device, if you’ve 
chosen to turn on your device’s location settings.” “° 











Purported legal basis 





23 





@ brave 





Purported legal basis 






































Category Purported processing purpose Other discoverable processing purposes Data collected Data shared externally Explanation and examples 
Search “helps us show you more useful search This vague language may conflate or omit many “your searches and activity from a number of other Google “As an example, if you type in “weather” in Search and 
results...” 50 distinct processing purposes. services are saved to your Google Account. The activity get weather results based on where you are, this 
saved to Web & App Activity may also include location activity, including the location used to provide this 
information... The location used and stored with your Web & result, is saved to your Web & App Activity.” ^5? 
App Activity can come from signals like the device’s IP 
address, your past activity, or from your device, if you’ve 
chosen to turn on your device’s location settings.” ^5! 
Search “Search results from other Google This vague language may conflate or omit many “You can search for information from other Google 
products”**3 distinct processing purposes. products you use, like Gmail or Google Calendar. Try 
searching for upcoming flights, restaurant 
reservations, or appointments.”*"* 
Search “How Google Search helps you find your own “Google Search can fetch useful information from Gmail, “Just search for things like ‘my dentist appointment’, 
information’”*°° Google Photos, Calendar and more. ... As long as you are ‘show me my photos at the beach’ or ‘where is my 
signed in, we will pull this information from other Google hotel reservation’.”*°" 
services” ^56 
Search “Provide personalised services, including This vague language may conflate or omit many “your previous searches and activity from other Google “For example, when you’re signed in to your Google 
content and ads. ... to customize our services | distinct processing purposes. services.” 59 Account and have the Web & App Activity control 
for you, including providing ... customized enabled, you can get more relevant search results that 
search results.” ^58 are based on your previous searches and activity from 
other Google services.” ^5? 
Search “This data helps Google give you more “such as...”*° is vague language that may “YouTube search history saves your YouTube searches. ... “both on and off Google” 
personalised experiences across Google conflate or omit many distinct processing This data may be saved and used in any Google service is vague language that may 
services, such as... faster searches ... both on | purposes. where you are signed in to give you more personalised indicate extensive or minor 
and off Google.”*** experiences.”*°3 data sharing with an 
unknowable number 
Google’s business 
partners.4@4 
Search “This data helps Google give you more “such as...”*°° is vague language that may “YouTube watch history saves the YouTube videos you “both on and off Google” 
personalised experiences across Google conflate or omit many distinct processing watch and listen to. ... This data may be saved and usedin (is vague language that may 
services, such as making your recently purposes. any Google service where you are signed in to give you more | indicate extensive or minor 
watched videos easier to find ... both on and personalised experiences.”“°’ data sharing with an 
off Google.”*°° unknowable number 
Google’s business 
partners.*®8 
Search “help make future searches faster ...”°° This vague language may conflate or omit many “Your YouTube search history”*”° 
distinct processing purposes. 
“YouTube recommends videos that you may like based on 
what you have watched before and what other people with 
similar viewing histories have watched before.”*”* 
Search “How Google auto-completes your “Our spelling correction model uses data from people who “That is how we know that when you type ‘Barsalona’, 
searches”*”2 have made the same mistake before to correct it for you. ... you most likely mean ‘Barcelona’. ...if you have 
Your search history can also help Google auto-complete your searched for ‘Barcelona flights’ before, we might 
searches.” 473 suggest this in the search box before you even finish 
typing it.”*”* 
Shopping “Your tracked prices are used by Google 
Shopping to send you price drop 
notifications.”*”> 
Stadia “help Google improve Stadia and provide | This vague language may conflate or omit many “Your Stadia Store activities, such as purchases, 


you with more personalised experiences 
across Google services.”*”° 


distinct processing purposes. 


subscriptions, code redemptions and other content that you 
claim...” 





Transactions 


“Provide our services. ... processing, fulfilling, 
and delivering your order’.*”® 


“When you purchase services or physical goods from us, you 
may provide us information like your shipping address or 
delivery instructions.” *”° 





Transactions 


“if you add a credit card or other payment 
method to your Google Account, you can use 
it to buy things across our services, like apps 





in the Play Store.” ^8? 








“a credit card or other payment method [,] ... your Google 
Account .... We may also ask for other information, like a 
business tax ID, to help process your payment.” 4*1 








“We also use algorithms to recognize patterns in 
data’*®2 
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Category 


Purported processing purpose 


Other discoverable processing purposes 


Data collected 


Data shared externally 


Explanation and examples 








Translation 


“Google Translate helps people communicate 
across languages by detecting common 
language patterns in phrases you ask it to 
translate.”*®3 


“phrases you ask it to translate.”*** 





Translation 


“Chrome’s built-in translation feature”*®° 


“the contents of a web page are only sent to Google if you 
decide to have it translated.”"° 





Unspecified 


Unknown. 


“Google Chrome uses a combined web address and search 
bar (we call it the “omnibox”) at the top of the browser 
window. ... On Android, your location will also be sent to 
Google via an X-Geo HTTP request header if Google is your 
default search engine, the Chrome app has the permission to 
use your geolocation, and you haven’t blocked geolocation 
for www.google.com (or country-specific origins such as 
www.google.de). Additionally, if your device has network 
location enabled (High Accuracy or Battery Saving Device 
Location mode in Android settings), the X-Geo header may 
also include visible network IDs (WiFi and Cell), used to 
geocode the request server-side.”**’ 





Unspecified 


“Google uses the information shared by sites 
and apps to deliver our services...” **° 


This vague language may conflate or omit many 
distinct processing purposes. 


“For example, when you visit a website that uses advertising 
services like AdSense, including analytics tools like Google 
Analytics, or embeds video content from YouTube, your web 
browser automatically sends certain information to Google. 
This includes the URL of the page you’re visiting and your IP 
address. We may also set cookies on your browser or read 
cookies that are already there. Apps that use Google 
advertising services also share information with Google, 
such as the name of the app and a unique identifier for 
advertising.”*°° 





Unspecified 


“Improve your experience across Google”*** 


This vague language may conflate or omit many 
distinct processing purposes. 


“If you add your phone number to your account’? 


“If “Across Google” is listed on your “Phone” page, this 
number can be used across Google services.” ^ 





Unspecified 


“to power future recommendations on 
Google” 


This vague language may conflate or omit many 
distinct processing purposes. 


“If you opt in to Location History and your device is reporting 
location, the precise location of your signed-in devices will 
be collected and stored, even when you’re not actively using 
a Google product or service.” *°> 





Unspecified 


“Measure performance. ... to understand how 
our services are used.”*°° 


This vague language may conflate or omit many 
distinct processing purposes. 





Unspecified 


Unknown. 


“We may also collect information about you from trusted 
partners, including marketing partners who provide us with 
information about potential customers of our business 
services’*°” 








Unspecified 


Unknown. 


“When you use Google services to do things like write a 
message in Gmail or comment on a YouTube video, we store 
the information you create. 

When you search for a restaurant on Google Maps or watch 
a video on YouTube, for example, we process information 
about that activity - including information like the video you 
watched, device IDs, IP addresses, cookie data, and location. 

We treat all of this as “personal information” when it’s 
associated with your Google Account. 

We also process the kinds of information described above 
when you use apps or sites that use Google services like ads, 
Analytics, and the YouTube video player.”*°* 





Unspecified 


“How your Google Assistant can help you get 
things done”*°? 


This vague language may conflate or omit many 
distinct processing purposes. 


“data from other Google services” 5® 


“For example, if you ask, ‘What coffee shops are 
nearby?’ or ‘Do I need an umbrella tomorrow?’, your 
Assistant uses information from Maps and Search as 
well as your location, interests and preferences to give 
you the most relevant answer.” 5% 








Unspecified 





“Your saved routines enable Google Assistant 
to do multiple things for you with just a 
single command.”°° 
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Category 


Purported processing purpose 


Other discoverable processing purposes 


Data collected 


Data shared externally 


Explanation and examples 








Unspecified 


“To help others find cool stuff online,” 


This vague language may conflate or omit many 
distinct processing purposes. 


“your activity (such as reviews, +1s, follows, shares, etc.) 
may be used along with your name and photo in commercial 
or other promotional contexts.” 5% 








Verify the data subject’s age 


“to verify that you meet age requirements” °° 


“In some cases, we may also need to verify your identity and 
may ask you for information to do this.” 5% 


‘We ask for authorization using a valid credit card or fora 
copy of a government issued ID in order to validate your 
date of birth. We only use this information to confirm your 
date of birth and to restore your account. If you choose the 
option to provide a copy of your government ID, we will 
destroy the copy of your government ID after we validate 
your date of birth. 

If you choose the option of a credit card authorization, we 
will confirm that the credit card is valid. We will retain this 
data as necessary to meet regulatory requirements for a 
credit card transaction, after which it will be deleted.”°= 


“if, for example, you enter an incorrect birthday 
indicating you’re not old enough to have a Google 
Account.”°°° 





Voice & Face input 


“context for the Google Assistant.” 51° 


“If you’ve enabled “Tap to Search” on Chrome Mobile you 
can search for terms by tapping them. ... Saying “Ok Google” 
after long-pressing on a word provides the word and its 
surrounding text as context for the Google Assistant.” 5"! 





Voice & Face input 


“Voice and Face Match allow your Assistant 
to tell you apart from others. This is done by 
creating unique models of your voice or face, 
which are stored only on devices that you 
enable.”*3 


“These models are initially created using data that you 
provided when you turned on Voice or Face Match.”*"* 





Voice & Face input 


“to create unique models of your voice and 
face stored on your enabled devices.”*1° 


“your Voice and Face Match enrolment data’>"® 





Voice & Face input 


“This data helps Google give you more 
personalised experiences across Google 
services, like improved speech recognition 
when you say “Hey Google” to speak to your 
Assistant, both on and off Google.”°"’ 


“.Like...”°*8 is vague language that may conflate or 
omit many distinct processing purposes. 


“Voice and audio recordings save a recording of your voice 
and other audio inputs in your Web & app activity on Google 
services and from sites, apps and devices that use or connect 
to Google speech services. The recording only happens when 
you use audio activation commands, like touch the 
microphone icon or say commands like “Hey Google,” and 
includes a few seconds before to catch your request at the 
right time.... This data may be saved and used in any Google 
service where you are signed in to give you more 
personalised experiences.”°'9 


“both on and off Google” 
is vague language that may 
indicate extensive or minor 
data sharing with an 
unknowable number 
Google’s business 
partners.°?° 





Google Account 


“desktop versions of Chrome, signing into or 
out of any Google web service, like 
google.com, signs you into or out of 
Chrome”*?2 


This vague language may conflate or omit many 
distinct processing purposes. 


“On both desktop and mobile, signing into Chrome keeps 
you signed into Google web services until you sign out of 
Chrome. On mobile, signing into Chrome will keep you 
signed in with all Google Accounts that have been added to 
the device. On desktop, it will keep you signed in with all 
Google Accounts that you added from a Google web service, 
unless you have set “Keep local data only until you quit your 
browser’ in your cookie settings. ...” 5? 





Google Account 


“Google uses your personal synchronized 
data to provide you a consistent browsing 








This vague language may conflate or omit many 
distinct processing purposes. 





“When you’re signed-in and have enabled sync with your 
Google Account, your personal browsing data information is 
saved in your Google Account so you may access it when you 
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Category 


Purported processing purpose 


Other discoverable processing purposes 


Data collected 


Data shared externally 


Explanation and examples Purported legal basis 








experience across your devices, and to 
customize features in Chrome.” °*4 


sign in and sync to Chrome on other computers and devices. 
Synced data can include bookmarks, saved passwords, open 
tabs, browsing history, extensions, addresses, phone 
numbers, payment methods, and more. In advanced sync 
settings, you can choose which types of data to synchronize 
with this device. By default, all syncable data types are 
enabled.” 55 





Google Account 


“Chrome may help you sign in with 
credentials you’ve saved in Android apps on 
websites that are associated with the 
respective apps. Likewise, credentials you’ve 
saved for websites can be used to help you 
sign into related Android app.” 57 


“passwords and/or other types of login credentials”>2* 


“If you’re signed into Chrome and are syncing 
passwords and/or other types of login credentials 
without a sync passphrase, these credentials are 
stored in your Google Account.” 59 





Google Account 


“Provide our services. ... use unique 
identifiers stored in cookies on your device to 
help us authenticate you as the person who 
should have access to your Google 
Account.”9?° 





Google Account 


“If users choose to download apps from the 
Google Play Store, they must have a Google 
account, which is necessary for, among other 
things, ... enabling parental controls.”°* 





Google Account 


“to help you access your account if you 
forget your password...” 53? 


“If you add your phone number to your account”®? 





Google Account 


“If users choose to download apps from the 
Google Play Store, they must have a Google 
account, which is necessary for, among other 
things, facilitating users to purchase apps...”°** 





Google Account 


“Security. ... We use security cookies to 
authenticate users ...” 5° 


“For example, we use cookies called ‘SID’ and ‘HSID’ 
which contain digitally signed and encrypted records 
of a user’s Google account ID and most recent sign-in 
time. The combination of these two cookies allows us 
to block many types of attack, such as attempts to 
steal the content of forms that you complete on web 
pages.”°36 





Google Account 


“Security. ... We use security cookies to... 


prevent fraudulent use of login credentials 
4537 


“For example, we use cookies called ‘SID’ and ‘HSID’ 
which contain digitally signed and encrypted records 
of a user’s Google account ID and most recent sign-in 
time. The combination of these two cookies allows us 
to block many types of attack, such as attempts to 
steal the content of forms that you complete on web 
pages.”°38 





Google Account 


“We organize your purchases and 
reservations in your Google Account to help 
you get things done. For example: You can 
ask your Google Assistant about the shipping 
status of a purchase. 

You can ask your Google Assistant to show 
you your flight reservations, or use Search to 
ask questions like, “Is my flight on time?”“°?° 


In this context, “...for example...” may cover 
multiple purposes. 54 


“Food orders or Google shopping orders placed through 
Search or Assistant 

Reservations for restaurants, hotels, and health and fitness 
bookings created using Search, Maps, or Assistant”! 





Research & Development 


“to help us build products better suited for 
your demographics.”°*? 


This vague language may conflate or omit many 
distinct processing purposes. 


“if you’re signed in to Chrome and have enabled Chrome 
sync, Chrome may combine your declared age and gender 
from your Google account with our statistics ...” °*? 





Research & Development 





“to improve our products and services, for 
example, by identifying web pages which 
load slowly; this gives us insight into how to 


best improve overall Chrome performance.” 
544 





In this context, “...for example, by...”°*° is vague 
language that may conflate or omit many distinct 
processing purposes. 





“If you have also turned on “Make searches and browsing 
better (Sends URLs of pages you visit to Google)” in the 
“Sync and Google services” section of Chrome’s settings, 
Chrome usage statistics include information about the web 





pages you visit and your usage of them. The information will 
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Explanation and examples 








also include the URLs and statistics related to downloaded 
files. If you sync extensions, these statistics will also include 
information about the extensions that have been installed 
from Chrome Web Store. The URLs and statistics are sent 
along with a unique device identifier’*“° 





Research & Development 


“Google also uses aggregated and 
anonymized synchronized browsing data to 
improve other Google products and services. 
For example, we use this information to 
improve Google Search by helping to detect 
mobile friendly pages, pages which have 
stopped serving content, and downloads of 
malware.” 


In this context, “...for example...” 5*8 is vague 


language that may conflate or omit many distinct 
processing purposes. 


“aggregated and anonymized synchronized browsing 
data...” *4° 








Research & Development 


“Google uses the information shared by sites 
and apps to ... develop new services...”°°° 


This vague language may conflate or omit many 
distinct processing purposes. 


“For example, when you visit a website that uses advertising 
services like AdSense, including analytics tools like Google 
Analytics, or embeds video content from YouTube, your web 
browser automatically sends certain information to Google. 
This includes the URL of the page you’re visiting and your IP 
address. We may also set cookies on your browser or read 
cookies that are already there. Apps that use Google 
advertising services also share information with Google, 
such as the name of the app and a unique identifier for 
advertising.”°>* 





Research & Development 


“Develop new services”>*? 


This vague language may conflate or omit many 
distinct processing purposes. 


“We use the information we collect in existing services to 
help us develop new ones.”55* 


“For example, understanding how people organized 


their photos in Picasa, Google’s first photos app, 


helped us design and launch Google Photos.”°°> 





Research & Development 


“Measure performance. ... we analyze data 
about your visits to our sites to do things like 
optimize product design”®"® 


“to do things like...”°°’ is vague language that 
may conflate or omit many distinct processing 
purposes. 





Research & Development 


“YouTube survey answers are used to 
improve the relevance of content and ads 
that you and others may see on YouTube and 
other Google products.” 


“YouTube surveys appear in the interface and ask about 
your YouTube experience or demographics/interests.”>°° 





Research & Development 


“to ... improve Google services” 


This vague language may conflate or omit many 
distinct processing purposes. 


“By including non-Google activity, Google will: 

Include your browsing data from non-Google websites and 
apps that partner with Google, including those that show 
ads from Google, in your Google Account 

Store that data with other data in your Google Account 
based on your activity controls preferences 

Use Google Account activity to make ads more useful to you 
on websites and apps, and improve Google services 

This setting applies across all of your signed-in devices and 
across all Google services.” °** 





Research & Development 


“a variety of purposes, including development of 
new products and services. We do not share 
permanent logs outside of Alphabet Inc. and its 
subsidiaries.”°* 


“Google Public DNS, is opt-in for Chrome users. Google 
retains two types of data from Google Public DNS queries: 
temporary logs and permanent logs: ... Permanent log data, 
which does not contain any personal information.”°°? 


“We do not share 
permanent logs outside of 
Alphabet Inc. and its 
subsidiaries’>* 





Research & Development 


“To help us improve Android, you can let your 
device send us information about how you 
use it and how it’s working.”5® 


“Battery level, How often you use your apps, Quality and 
length of your network connections (like mobile, Wi-Fi, and 
Bluetooth)’”>©© 


“Some aggregated info can 
help partners, like Android 
developers, make their 
apps and products better, 
too.” 567 


“For example, Google can use usage and diagnostics 


info to improve: Battery life: Google can use info 


about what’s using the most battery on your device to 
help make common features use less battery. Crashing 


or freezing on devices: Google can use info about 
when apps crash and freeze on your device to help 
make the Android operating system more reliable. 


"568 





Research & Development 





“help train Google’s language models...”55° 





“information that’s publicly available online or from other 





public sources”*”° 
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Research & Development 


“Google can use this data to improve its 
speech recognition so it can understand you 
better.”°7* 


“If you turn this setting on and use voice commands (such as 
“Ok Google”) or touch the microphone icon, Google will save 
a recording of your voice and other audio inputs.”°’* 


“Google uses your voice and audio recordings to: 
Learn the sound of your voice. 

Learn how you say words and phrases. 

Recognize when you say activation commands, like 
“Hey Google’”...”°73 





Research & Development 


“Improve speech recognition across Google 
products that use your voice.”°”* 


This may use federated 
learning, and process 


“Improvements to speech models may also be sent to 
Google without uploading your voice and audio 
recordings. For example, when the Improve Gboard 
setting is on, Gboard can improve word suggestions 


for everyone without sending what you say to the 
n575 


personal data only on the 
device. If so, a legal basis 
may not be required. 


server. 





Research & Development 








“help ... build features like Google 


Translate” 57 





“.help...build features like...”°”* is vague 
language that may conflate or omit many distinct 
processing purposes. 





“information that’s publicly available online or from other 
public sources”®™? 














Appendix: information given when a person signs up for a Google Account 
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“Web & App Activity” dialogues at sign up 
Clicking “Learn more” reveals the dialogue shown on the right. 


On by default 





Google 
Privacy and Terms 


SHOUTS. FI HUIS Wee pIE VU omar 
results, suggestions and personalisation across 
Google services. 


Save my Web & app activity in my Google 
Account 


Web & App Activity 





When this option is on, data saved in your Google Account may include 





O Don't save my Wed & app activity in my 


Google Account + Your searches and things that you do on other Google services, including your 


location and other associated data 
+ Your Chrome héstory (if Chrome Sync ts tumed on) 





G ye 


Learn more + Your activity from sites, apps and devices that use Google services 
Personalisation , 
O Ads You're in control of the data we 
Google can show you ads based on your activity on collect and how it’s used 


Google services (such as Search or YouTube), and 
on websites and apps that partner with Google. 


© Show me personalised ads 


English (United Kingdom) + Help Privacy Terms 





“Location History” dialogues at sign up 
Clicking “Learn more” reveals the dialogue shown on the right. 
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Google 


Privacy and Terms 


I Location History 
Saves a private map of where you go with your 
signed-in devices (even when you're not actively 
using a Google product) to give you better map 
searches, commute routes and more. 


Location History 


Location History helps you get useful information, such as commute predictions and 
improved search results, and more useful ads on and off Google. It does this by 
Creating a private map of where you go with your signed-in devices 





Save my Location History in my Google 
Account To create this map, Google regularly obtains location data from devices for which 
[=] @ you've tumed on Location History. This data is collected even when you aren't using a 
specific Google product 
You're in control of the data we 
l collect and how it's used 


Don't save my Location History in my Google 
Account 


C Send me occasional reminders about these settings 





English (United Kingdom) ~ Heip Privacy Terms 
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“YouTube History” text at sign up 


Google 


Privacy and Terms 


E YouTube history On by default 


Saves the YouTube videos that you watch and the 
things that you search for on YouTube. This helps 
Google give you better recommendations, 

remember where you left off and more 









Save my YouTube history in my Google 
Account 


o ——— h 
Don't save my YouTube history in my Google B F g 
O Account 









You're in control of the data we 
g Location History collect and how it’s used 


Saves a private map of where you go with your 

signed-in devices (even when you're not actively 
using a Google product) to give you better map 

searches, commute routes and more. 


English (United Kingdom) + Help Privacy Terma 
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Notes 


1 Article 6(1)b, the General Data Protection Regulation. 

2 URL: https://policies.google.com/technologies/retention#purpose-financial. Note: visit using a personal Google Account. Some settings or text may not 
be visible to Google Business Accounts. 

3 ibid. 

4 ibid. 

> ibid. 

6 ibid. 

7 ibid. 

8 ibid. 

? ibid, 

10 ibid. 

11 ibid. 

12 ibid. 

13 ibid. 

14 ibid. 

15 ibid. 

16 ibid. 

Y ibid. 

18 ibid. 

19 ibid. 

20 URL: https://policies.google.com/technologies/ads. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

21 ibid. 

22 ibid. 

22 ibid. 

24 Google’s submission responding to questions for the record from US Congress Judiciary Subcommittee on Antitrust, Commercial, and Administrative 
Law, hearing on “Online platforms and market power, part 2”, 16 July 2019 (URL: https://docs.house.gov/meetings/JU/JU05/20190716/109793/HHRG- 
116-JU05-20190716-SD030.pdf), pp. 62-64. 

25 ibid. 

26“ ibid., p. 75. 
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27 URL: https://policies.google.com/technologies/types. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

28 ibid. 

2° Google’s submission responding to questions for the record from US Congress Judiciary Subcommittee on Antitrust, Commercial, and Administrative 
Law, hearing on “Online platforms and market power, part 2”, 16 July 2019 (URL: https://docs.house.gov/meetings/JU/JU05/20190716/109793/HHRG- 
116-JU05-20190716-SD030.pdf), pp. 62-64. 

30 ibid, 

31 ibid. 

32 ibid. 

33 ibid. 

34 ibid. 

35 ibid. 

3° ibid. 

37 ibid. 

38 URL: https://developers.google.com/authorized-buyers/rtb/start 

39 URL: https://developers.google.com/authorized-buyers/rtb/realtime-bidding-guide 

40 URL: https://support.google.com/admanager/answer/9012903 

41 URL: https://developers.google.com/third-party-ads/adx-vendors 

42 URL: https://www.google.com/doubleclick/adxbuyer/guidelines/ 

43 URL: https://policies.google.com/technologies/partner-sites. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

^ ibid. 

45 URL: https://policies.google.com/privacy#enforcement. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

46 ibid. 

47 URL: https://policies.google.com/privacy#footnote-content-views. Note: visit using a personal Google Account. Some settings or text may not be visible 
to Google Business Accounts. 

48 ibid. 

49 URL: https://policies.google.com/privacy/google-partners. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

50 ibid. 
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51 “Your location information” in URL: https://policies.google.com/privacy#infocollect. Note: visit using a personal Google Account. Some settings or text 
may not be visible to Google Business Accounts. 

2 URL: https://policies.google.com/privacy/google-partners. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

°3 URL: https://policies.google.com/technologies/ads. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

54 ibid. 

°° URL: https://policies.google.com/technologies/types. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

°° ibid. 

7 ibid. 

58 ibid. 

°° ibid. 

© ibid. 

61 ibid. 

62 ibid. 

63 ibid. 

64 URL: https://policies.google.com/privacy#enforcement. Note: visit using a personal Google Account from within the European Economic Area. Some 
settings or text may not be visible to Google Business Accounts. 

6 Google’s submission responding to questions for the record from US Congress Judiciary Subcommittee on Antitrust, Commercial, and Administrative 
Law, hearing on “Online platforms and market power, part 2”, 16 July 2019 (URL: https://docs.house.gov/meetings/JU/JU05/20190716/109793/HHRG- 
116-JU05-20190716-SD030.pdf), pp. 62-64. 

6 ibid. 

67 “How is location used to show ads?” in URL: https://policies.google.com/technologies/location-data 

68 URL: https://support.google.com/google-ads/answer/6100636. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

6 URL: https://policies.google.com/technologies/types. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

70 ibid. 

71 ibid. 

72 ibid. 

73 ibid. 
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74 ibid. 

7> ibid. 

76 ibid. 

77 ibid. 

78 ibid. 

79 URL: https://policies.google.com/technologies/partner-sites. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

80 ibid. 

81 URL: https://support.google.com/accounts/answer/27442#gender. Note: visit using a personal Google Account. Some settings or text may not be visible 
to Google Business Accounts. 

82 ibid. 

83 ibid. 

84 URL: https://policies.google.com/technologies/partner-sites. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

85 ibid. 

86 URL: https://support.google.com/accounts/answer/27442 

87 ibid. 

88 “Include Chrome history and activity from sites, apps and devices that use Google services” (once clicked) in URL: 
https://myaccount.google.com/activitycontrols. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

3? ibid. 

% ibid. 

91 “ibid. 

2 “Location History” (once clicked) in URL: https://myaccount.google.com/activitycontrols. Note: visit using a personal Google Account. Some settings or 
text may not be visible to Google Business Accounts. 

33 ibid. 

%4 ibid. 

% ibid. 

% “Using data to make ads more useful to you” in “Ads and data” URL: https://safety.google/privacy/ads-and-data/. Note: visit using a personal Google 
Account. Some settings or text may not be visible to Google Business Accounts. 

97 ibid. 

38 ibid. 
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°9 ibid. 

100 ibid. 

101 ibid. 

102 ibid. 

103 ibid. 

104 ibid. 

105 ibid. 

106 ibid. 

107 ibid. 

108 ibid. 

109 ibid. 

110 “Ad personalization” (when clicked) in URL: https://adssettings.google.com/authenticated?hl=en. Note: visit using a personal Google Account. Some 
settings or text may not be visible to Google Business Accounts. 

111 ibid. 

112 ibid. 

113 ibid. 

114 URL: https://policies.google.com/technologies/types. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

115 ibid. 

116 ibid. 

117 ibid. 

118 ibid. 

119 ibid. 

120 “Web & App Activity “ in URL: https://policies.google.com/technologies/location-data. Note: visit using a personal Google Account. Some settings or 
text may not be visible to Google Business Accounts. 

121 ibid. 

122 “Also use your activity & information from Google services to personalize ads on websites and apps that partner with Google to show ads. This stores 
data from websites and apps that partner with Google in your Google Account.” (when clicked) in URL: 
https://adssettings.google.com/authenticated?hl=en. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

123 ibid. 

124 ibid. 
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125 ibid. 

126 “How is location used to show ads?” in URL: https://policies.google.com/technologies/location-data. Note: visit using a personal Google Account. Some 
settings or text may not be visible to Google Business Accounts. 

127 ibid. 

128 URL: https://policies.google.com/privacy#whycollect. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

129 URL: https://support.google.com/ads/answer/1634057. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

130 URL: https://policies.google.com/privacy#footnote-unique-id. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

131 URL: https://policies.google.com/privacy#whycollect. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

132 URL: https://policies.google.com/privacy#footnote-personalized-ads. Note: visit using a personal Google Account. Some settings or text may not be 
visible to Google Business Accounts. 

133 URL: https://safety.google/privacy/privacy-controls/. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

134 “Understanding how Google ads work” in “Ads and data” URL: https://safety.google/privacy/ads-and-data/. Note: visit using a personal Google 
Account. Some settings or text may not be visible to Google Business Accounts. 

135 “Using data to make ads more useful to you” in “Ads and data” URL: https://safety.google/privacy/ads-and-data/. Note: visit using a personal Google 
Account. Some settings or text may not be visible to Google Business Accounts. 

136 ibid. 

137 ibid. 

138 URL: https://policies.google.com/privacy#footnote-phone-number. Note: visit using a personal Google Account. Some settings or text may not be 
visible to Google Business Accounts. 

139 ibid. 

140 URL: https://support.google.com/accounts/answer/3463280. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

141 “Include your searches on YouTube” (once clicked) in URL: https://myaccount.google.com/activitycontrols. Note: visit using a personal Google Account. 
Some settings or text may not be visible to Google Business Accounts. 

142 ibid. 

143 ibid. 

144 ibid. 
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145 “Include the YouTube videos that you watch” (once clicked) in URL: https://myaccount.google.com/activitycontrols. Note: visit using a personal Google 
Account. Some settings or text may not be visible to Google Business Accounts. 

146 “Include the YouTube videos that you watch” (once clicked) in URL: https://myaccount.google.com/activitycontrols. Note: visit using a personal Google 
Account. Some settings or text may not be visible to Google Business Accounts. 

1 ibid. 

148 ibid. 

149 URL: https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage and see also URL: 
https://marketingplatform.google.com/about/optimize/. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

150 ibid. 

151 URL: https://support.google.com/analytics/answer/6004245. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

152 ibid., when one clicks the heading “What is the data used for?”. 

153 ibid., when one clicks the heading “Data Collected by Google Analytics”. 

154 URL: https://policies.google.com/privacy#whycollect. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

155 URL: https://policies.google.com/privacy#footnote-link-info. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

156 “Your apps, browsers & devices” in URL: https://policies.google.com/privacy#infocollect. Note: visit using a personal Google Account. Some settings or 
text may not be visible to Google Business Accounts. 

157 ibid. 

158 ibid. 

159 ibid. 

160 ibid. 

161 ibid. 

162 ibid. 

163 ibid. 

164 Google’s submission responding to questions for the record from US Congress Judiciary Subcommittee on Antitrust, Commercial, and Administrative 
Law, hearing on “Online platforms and market power, part 2”, 16 July 2019 (URL: https://docs.house.gov/meetings/JU/JU05/20190716/109793/HHRG- 
116-JU05-20190716-SD030.pdf), pp. 96-97. 

165 ibid. 
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166 URL: https://policies.google.com/technologies/partner-sites. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

167 ibid. 

168 URL: https://policies.google.com/privacy#enforcement. Note: visit using a personal Google Account from within the European Economic Area. Some 
settings or text may not be visible to Google Business Accounts. 

169 URL: https://policies.google.com/privacy#footnote-devices. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

170 “Your apps, browsers & devices” in URL: https://policies.google.com/privacy#infocollect. Note: visit using a personal Google Account. Some settings or 
text may not be visible to Google Business Accounts. 

171 URL: https://policies.google.com/privacy#infosharing. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

172 URL: https://policies.google.com/privacy#footnote-safety-reliability. Note: visit using a personal Google Account. Some settings or text may not be 
visible to Google Business Accounts. 

173 ibid. 

174 ibid. 

175 URL: https://policies.google.com/technologies/retention. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

176 URL: https://policies.google.com/privacy#footnote-unique-id. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

177 URL: https://policies.google.com/privacy#footnote-safety-reliability. Note: visit using a personal Google Account. Some settings or text may not be 
visible to Google Business Accounts. 

178 ibid. 

179 ibid. 

180 ibid. 

181 URL: https://policies.google.com/technologies/retention. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

182 URL: https://policies.google.com/privacy#footnote-unique-id. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

183 URL: https://policies.google.com/privacy#footnote-safety-reliability. Note: visit using a personal Google Account. Some settings or text may not be 
visible to Google Business Accounts. 

184 ibid. 

185 ibid. 
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186 URL: https://policies.google.com/privacy#footnote-unique-id. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

187 URL: https://policies.google.com/privacy#footnote-safety-reliability. Note: visit using a personal Google Account. Some settings or text may not be 
visible to Google Business Accounts. 

188 URL: https://policies.google.com/technologies/types. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

189 ibid. 

190 URL: https://policies.google.com/privacy#footnote-safety-reliability. Note: visit using a personal Google Account. Some settings or text may not be 
visible to Google Business Accounts. 

191 “Your location information” in URL: https://policies.google.com/privacy#infocollect. Note: visit using a personal Google Account. Some settings or text 
may not be visible to Google Business Accounts. 

192 URL: https://policies.google.com/privacy/google-partners. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

193 URL: https://policies.google.com/privacy#enforcement. Note: visit using a personal Google Account from within the European Economic Area. Some 
settings or text may not be visible to Google Business Accounts. 

194 URL: https://policies.google.com/privacy#infosharing. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

195 URL: https://policies.google.com/privacy#footnote-safety-reliability. Note: visit using a personal Google Account. Some settings or text may not be 
visible to Google Business Accounts. 

196 “Your location information” in URL: https://policies.google.com/privacy#infocollect. Note: visit using a personal Google Account. Some settings or text 
may not be visible to Google Business Accounts. 

197 URL: https://policies.google.com/privacy/google-partners. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

198 URL: https://policies.google.com/privacy#infosharing. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

199 URL: https://policies.google.com/privacy#footnote-safety-reliability. Note: visit using a personal Google Account. Some settings or text may not be 
visible to Google Business Accounts. 

200 “Your location information” in URL: https://policies.google.com/privacy#infocollect. Note: visit using a personal Google Account. Some settings or text 
may not be visible to Google Business Accounts. 

201 URL: https://policies.google.com/privacy/google-partners. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 
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202 URL: https://policies.google.com/privacy#infosharing. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

203 URL: https://policies.google.com/privacy#footnote-safety-reliability. Note: visit using a personal Google Account. Some settings or text may not be 
visible to Google Business Accounts. 

204 ibid. 

205 ibid. 

206 URL: https://policies.google.com/technologies/retention. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

207 URL: https://policies.google.com/privacy#footnote-unique-id. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

208 URL: https://policies.google.com/privacy#footnote-safety-reliability. Note: visit using a personal Google Account. Some settings or text may not be 
visible to Google Business Accounts. 

209 ibid. 

210 ibid. 

211 ibid. 

212 URL: https://policies.google.com/privacy#footnote-unique-id. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

213 URL: https://policies.google.com/privacy#footnote-detect-abuse. Note: visit using a personal Google Account. Some settings or text may not be visible 
to Google Business Accounts. 

214 URL: https://policies.google.com/privacy#footnote-safety-reliability. Note: visit using a personal Google Account. Some settings or text may not be 
visible to Google Business Accounts. 

215 ibid. 

216 ibid. 

217 URL: https://policies.google.com/privacy#footnote-unique-id. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

218 URL: https://policies.google.com/privacy#footnote-detect-abuse. Note: visit using a personal Google Account. Some settings or text may not be visible 
to Google Business Accounts. 

219 URL: https://policies.google.com/privacy#infosharing. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

220 URL: https://www.google.com/chrome/privacy/whitepaper.html#malware. Note: visit using a personal Google Account. Some settings or text may not 
be visible to Google Business Accounts. 

221 ibid. 
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222 ibid. 

223 ibid. 

224 ibid. 

225 ibid. 

226 URL: https://www.google.com/chrome/privacy/whitepaper.html#unwantedsoftware. Note: visit using a personal Google Account. Some settings or 
text may not be visible to Google Business Accounts. 

227 ibid. 

228 URL: https://www.google.com/chrome/privacy/whitepaper.html#update. Note: visit using a personal Google Account. Some settings or text may not 
be visible to Google Business Accounts. 

229 ibid. 

230 ibid. 

231 ibid. 

232 URL: https://www.google.com/chrome/privacy/whitepaper.html#navtips. Note: visit using a personal Google Account. Some settings or text may not 
be visible to Google Business Accounts. 

233 ibid. 

234 URL: https://www.google.com/chrome/privacy/whitepaper.html#measurepromotions. Note: visit using a personal Google Account. Some settings or 
text may not be visible to Google Business Accounts. 

235 ibid. 

236 URL: https://www.google.com/chrome/privacy/whitepaper.html#usagestats. Note: visit using a personal Google Account. Some settings or text may 
not be visible to Google Business Accounts. 

237 ibid. 

238 URL: https://www.google.com/chrome/privacy/whitepaper.html#spelling. Note: visit using a personal Google Account. Some settings or text may not 
be visible to Google Business Accounts. 

239 ibid. 

2% ibid. 

41 URL: https://policies.google.com/privacy#whycollect. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

242 ibid. 

243 ibid. 

244 ibid. 

245 URL: https://policies.google.com/privacy#enforcement. Note: visit using a personal Google Account from within the European Economic Area. Some 
settings or text may not be visible to Google Business Accounts. 
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46 URL: https://policies.google.com/privacy#whycollect 

247 “Crisis Response User Reports” in URL: https://myactivity.google.com/more-activity. Note: visit using a personal Google Account. Some settings or text 
may not be visible to Google Business Accounts. 

248 URL: https://policies.google.com/privacy#whycollect. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

249 ibid. 

250 URL: https://policies.google.com/privacy#footnote-deliver-services. Note: visit using a personal Google Account. Some settings or text may not be 
visible to Google Business Accounts. 

251 ibid. 

252 URL: https://policies.google.com/privacy#footnote-safety-reliability. Note: visit using a personal Google Account. Some settings or text may not be 
visible to Google Business Accounts. 

253 ibid. 

254 ibid. 

255 URL: https://policies.google.com/privacy#footnote-unique-id. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

256 URL: https://policies.google.com/privacy#footnote-detect-abuse. Note: visit using a personal Google Account. Some settings or text may not be visible 
to Google Business Accounts. 

257 URL: https://policies.google.com/privacy#whycollect. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

258 ibid. 

259 URL: https://policies.google.com/privacy#footnote-deliver-services. Note: visit using a personal Google Account. Some settings or text may not be 
visible to Google Business Accounts. 

260 URL: https://policies.google.com/privacy#footnote-unique-id. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

61 URL: https://policies.google.com/privacy#footnote-unique-id. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

262 ibid. 

63 URL: https://policies.google.com/technologies/retention#purpose-continuity. Note: visit using a personal Google Account. Some settings or text may 
not be visible to Google Business Accounts. 

264 ibid. 

65 URL: https://policies.google.com/privacy#whycollect. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 
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266 URL: https://policies.google.com/technologies/types. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

267 ibid. 

268 ibid. 

269 ibid. 

270 “Gboard learned words” in URL: https://myactivity.google.com/more-activity. Note: visit using a personal Google Account. Some settings or text may 
not be visible to Google Business Accounts. 

271 ibid. 

272 ibid. 

273 ibid. 

274 URL: https://policies.google.com/privacy#infosharing. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

275 “Nhy does Google use location information?” in URL: https://policies.google.com/technologies/location-data 

276 URL: https://policies.google.com/privacy#infocollect. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

277 URL: https://policies.google.com/privacy#footnote-near-device. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

278 “Usage & diagnostics for Location History” in URL: https://support.google.com/accounts/answer/3118687. Note: visit using a personal Google Account. 
Some settings or text may not be visible to Google Business Accounts. 

279 ibid. 

280 “Location History” (once clicked) in URL: https://myaccount.google.com/activitycontrols. Note: visit using a personal Google Account. Some settings or 
text may not be visible to Google Business Accounts. 

281 ibid. 

282 ibid. 

283 ibid. 

284 URL: https://safety.google/privacy/data/. Note: visit using a personal Google Account. Some settings or text may not be visible to Google Business 
Accounts. 

285 ibid. 

286 ibid. 

287 “Nhy does Google use location information?” in URL: https://policies.google.com/technologies/location-data. Note: visit using a personal Google 
Account. Some settings or text may not be visible to Google Business Accounts. 
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288 URL: https://policies.google.com/privacy#infocollect. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

289 URL: https://policies.google.com/privacy#footnote-near-device. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

290 “Your location information” in URL: https://policies.google.com/privacy#infocollect. Note: visit using a personal Google Account. Some settings or text 
may not be visible to Google Business Accounts. 

291 ibid. 

292 URL: https://policies.google.com/privacy#infocollect. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

293 URL: https://policies.google.com/privacy#footnote-near-device. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

294 URL: https://support.google.com/accounts/answer/6139018. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

295 ibid. 

296 ibid. 

297 “Location History” in “Privacy Checkup” URL: https://myaccount.google.com/privacycheckup. Note: visit using a personal Google Account. Some 
settings or text may not be visible to Google Business Accounts. 

238 “Google Location History” in URL: https://policies.google.com/technologies/location-data. Note: visit using a personal Google Account. Some settings 
or text may not be visible to Google Business Accounts. 

29 Location data collection methods at URL: https://policies.google.com/technologies/location-data#how-find. Note: visit using a personal Google 
Account. Some settings or text may not be visible to Google Business Accounts. 

300 URL: https://support.google.com/accounts/answer/6139018. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

301 “Location History creates a private map of where you go with your signed-in phones” 

302 “Location History” in “Privacy Checkup” URL: https://myaccount.google.com/privacycheckup. Note: visit using a personal Google Account. Some 
settings or text may not be visible to Google Business Accounts. 

303 “Your location information” in URL: https://policies.google.com/privacy#infocollect. Note: visit using a personal Google Account. Some settings or text 
may not be visible to Google Business Accounts. 

304 ibid. 

305 URL: https://policies.google.com/privacy#infocollect. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 
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396 URL: https://policies.google.com/privacy#footnote-near-device. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

307 “Location History” (once clicked) in URL: https://myaccount.google.com/activitycontrols 

308 ibid. 

309 ibid. 

310 ibid. 

311 “Google Location History” in URL: https://policies.google.com/technologies/location-data. Note: visit using a personal Google Account. Some settings 
or text may not be visible to Google Business Accounts. 

312 See location data collection methods at URL: https://policies.google.com/technologies/location-data#how-find. Note: visit using a personal Google 
Account. Some settings or text may not be visible to Google Business Accounts. 

313 “What happens after you delete some or all Location History” in URL: https://support.google.com/accounts/answer/3118687. Note: visit using a 
personal Google Account. Some settings or text may not be visible to Google Business Accounts. 

314 ibid. 

315 “Google Location History” in URL: https://policies.google.com/technologies/location-data. Note: visit using a personal Google Account. Some settings 
or text may not be visible to Google Business Accounts. 

316 See location data collection methods at URL: https://policies.google.com/technologies/location-data#how-find. Note: visit using a personal Google 
Account. Some settings or text may not be visible to Google Business Accounts. 

317 “What happens after you delete some or all Location History” in URL: https://support.google.com/accounts/answer/3118687. Note: visit using a 
personal Google Account. Some settings or text may not be visible to Google Business Accounts. 

318 ibid. 

319 URL: https://policies.google.com/technologies/partner-sites. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

320 ibid. 

321 URL: https://policies.google.com/privacy#enforcement. Note: visit using a personal Google Account from within the European Economic Area. Some 
settings or text may not be visible to Google Business Accounts. 

322 URL: https://policies.google.com/privacy#whycollect. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

323 ibid. 

324 URL: https://policies.google.com/privacy#footnote-make-improvements. Note: visit using a personal Google Account. Some settings or text may not be 
visible to Google Business Accounts. 

325 URL: https://policies.google.com/privacy#enforcement. Note: visit using a personal Google Account from within the European Economic Area. Some 
settings or text may not be visible to Google Business Accounts. 
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326 URL: https://policies.google.com/privacy#whycollect. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

327 URL: https://policies.google.com/privacy#footnote-ensure-working. Note: visit using a personal Google Account. Some settings or text may not be 
visible to Google Business Accounts. 

328 URL: https://www.google.com/chrome/privacy/whitepaper.html#translate 

329 ibid. 

330 URL: https://www.google.com/chrome/privacy/whitepaper.html#descriptions 

331 ibid. 

332 ibid. 

333 URL: https://www.google.com/chrome/privacy/whitepaper.html#signin 

334 ibid. 

335 URL: https://safety.google/privacy/data/. Note: visit using a personal Google Account. Some settings or text may not be visible to Google Business 
Accounts. 

336 ibid. 

337 URL: https://www.google.com/chrome/privacy/whitepaper.html#omnibox 

338 ibid. 

339 ibid. 

340 URL: https://www.google.com/chrome/privacy/whitepaper.html#NTP 

341 ibid. 

342 ibid. 

343 ibid, 

344 ibid. 

345 ibid. 

346 URL: https://policies.google.com/privacy#enforcement. Note: visit using a personal Google Account from within the European Economic Area. Some 
settings or text may not be visible to Google Business Accounts. 

347 ibid. 

348 URL: https://policies.google.com/technologies/partner-sites. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

349 ibid. 

350 ibid. 

351 ibid. 
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352 URL: https://policies.google.com/privacy#whycollect. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

353 “Include Chrome history and activity from sites, apps and devices that use Google services” (once clicked) in URL: 
https://myaccount.google.com/activitycontrols. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

354 ibid. 

355 ibid. 

356 ibid. 

357 “YouTube History” (once clicked) in URL: https://myaccount.google.com/activitycontrols. Note: visit using a personal Google Account. Some settings or 
text may not be visible to Google Business Accounts. 

358 ibid. 

359 ibid. 

380 ibid. 

361 “Include your searches on YouTube” (once clicked) in URL: https://myaccount.google.com/activitycontrols. Note: visit using a personal Google Account. 
Some settings or text may not be visible to Google Business Accounts. 

362 ibid. 

363 ibid. 

364 ibid. 

365 “Include the YouTube videos that you watch” (once clicked) in URL: https://myaccount.google.com/activitycontrols. Note: visit using a personal Google 
Account. Some settings or text may not be visible to Google Business Accounts. 

366 ibid. 

367 ibid. 

368 ibid. 

369 https://myactivity.google.com/page?utm_source=my-activity&page=play_library. Note: visit using a personal Google Account. Some settings or text 
may not be visible to Google Business Accounts. 

370 ibid. 

371 https://support.google.com/accounts/answer/27442. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

372 ibid. 

373 URL: https://support.google.com/accounts/answer/7673989. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

374 ibid. 
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375 URL: https://policies.google.com/privacy#infocollect. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

376 ibid. 

377 ibid. 

378 “YouTube ‘Not interested’ feedback” in URL: https://myactivity.google.com/more-activity. Note: visit using a personal Google Account. Some settings 
or text may not be visible to Google Business Accounts. 

379 URL: https://support.google.com/youtube/answer/6125535. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

380 URL: https://myactivity.google.com/page?utm_source=my-activity&page=news_preferences. Note: visit using a personal Google Account. Some 
settings or text may not be visible to Google Business Accounts. 

381 ibid. 

382 ibid. 

383 URL: https://myactivity.google.com/page?utm_source=my-activity&page=shopping_orders. Note: visit using a personal Google Account. Some settings 
or text may not be visible to Google Business Accounts. 

384 URL: https://support.google.com/googleshopping/answer/9116422 

385 URL: https://myactivity.google.com/page?utm_source=my-activity&page=shopping_ orders. Note: visit using a personal Google Account. Some settings 
or text may not be visible to Google Business Accounts. 

386 ibid. 

387 URL: https://support.google.com/googleshopping/answer/9116422. Note: visit using a personal Google Account. Some settings or text may not be 
visible to Google Business Accounts. 

388 “Google Word Coach” in URL: https://myactivity.google.com/more-activity. Note: visit using a personal Google Account. Some settings or text may not 
be visible to Google Business Accounts. 

389 URL: https://support.google.com/accounts/answer/6139018. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

390 ibid. 

391 “Clear not interested feedback” in URL: https://support.google.com/youtube/answer/6125535. Note: visit using a personal Google Account. Some 
settings or text may not be visible to Google Business Accounts. 

392 “Include Chrome history and activity from sites, apps and devices that use Google services” (once clicked) in URL: 
https://myaccount.google.com/activitycontrols. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

333 ibid. 

394 ibid. 
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395 ibid. 

396 “Location History” (once clicked) in URL: https://myaccount.google.com/activitycontrols. Note: visit using a personal Google Account. Some settings or 
text may not be visible to Google Business Accounts. 

397 ibid. 

398 ibid. 

39 ibid. 

400 ibid. 

401 ibid. 

402 ibid. 

403 ibid. 

404 “YouTube Search History” in “Privacy Checkup” URL: https://myaccount.google.com/privacycheckup. Note: visit using a personal Google Account. 
Some settings or text may not be visible to Google Business Accounts. 

405 URL: https://support.google.com/accounts/answer/6139018?hl=en&ref_topic=7188674. Note: visit using a personal Google Account. Some settings or 
text may not be visible to Google Business Accounts. 

406 URL: https://safety.google/privacy/data/ 

407 URL: https://support.google.com/accounts/answer/6139018. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

408 ibid. 

409 ibid. 

410 ibid. 

^tt ibid. 

412 “Google Location History” in URL: https://policies.google.com/technologies/location-data. Note: visit using a personal Google Account. Some settings 
or text may not be visible to Google Business Accounts. 

413 See location data collection methods at URL: https://policies.google.com/technologies/location-datałhow-find. Note: visit using a personal Google 
Account. Some settings or text may not be visible to Google Business Accounts. 

414 “What happens after you delete some or all Location History” in URL: https://support.google.com/accounts/answer/3118687. Note: visit using a 
personal Google Account. Some settings or text may not be visible to Google Business Accounts. 

415 ibid. 

416 URL: https://policies.google.com/privacy#footnote-unique-id. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

417 ibid. 
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418 URL: https://policies.google.com/technologies/types. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

at? ibid. 

420 “YouTube History” (once clicked) in URL: https://myaccount.google.com/activitycontrols. Note: visit using a personal Google Account. Some settings or 
text may not be visible to Google Business Accounts. 

%21 ibid. 

422 ibid. 

423 ibid. 

424 “YouTube Watch History” in “Privacy Checkup” URL: https://myaccount.google.com/privacycheckup. Note: visit using a personal Google Account. Some 
settings or text may not be visible to Google Business Accounts. 

425 URL: https://support.google.com/accounts/answer/6139018. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

426 ibid. 

427 URL: https://policies.google.com/privacy#footnote-phone-number and URL: https://support.google.com/accounts/answer/3113316. Note: visit using a 
personal Google Account. Some settings or text may not be visible to Google Business Accounts. 

428 ibid. 

429 URL: https://policies.google.com/privacy#footnote-deliver-services. Note: visit using a personal Google Account. Some settings or text may not be 
visible to Google Business Accounts. 

430 URL: https://myactivity.google.com/page?utm_source=my-activity&page=podcast_subscriptions. Note: visit using a personal Google Account. Some 
settings or text may not be visible to Google Business Accounts. 

431 URL: https://www.google.com/chrome/privacy/whitepaper.html#omnibox 

432 ibid. 

433 ibid. 

434 ibid. 

435 URL: https://www.google.com/chrome/privacy/whitepaper.html#searchlocale 

428 ibid. 

437 URL: https://www.google.com/chrome/privacy/whitepaper.html#tap 

438 ibid. 

439 ibid. 

44 ibid. 

441 ibid. 

442 ibid. 
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443 URL: https://support.google.com/accounts/answer/6139018. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

444 ibid. 

445 Google’s submission responding to questions for the record from US Congress Judiciary Subcommittee on Antitrust, Commercial, and Administrative 
Law, hearing on “Online platforms and market power, part 2”, 16 July 2019 (URL: https://docs.house.gov/meetings/JU/JU05/20190716/109793/HHRG- 
116-JU05-20190716-SD030.pdf), p. 4. 

446 URL: https://policies.google.com/privacy#whycollect. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

447 ibid. 

448 “Web & App Activity “ in URL: https://policies.google.com/technologies/location-data. Note: visit using a personal Google Account. Some settings or 
text may not be visible to Google Business Accounts. 

449 ibid. 

450 ibid. 

451 ibid. 

422 ibid. 

43 URL: https://support.google.com/websearch/answer/1710607. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

434 ibid. 

455 URL: https://safety.google/privacy/data/. Note: visit using a personal Google Account. Some settings or text may not be visible to Google Business 
Accounts. 

#98 ibid, 

457 ibid. 

458 URL: https://policies.google.com/privacy#whycollect. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

45° ibid. 

469 URL: https://policies.google.com/privacy#footnote-customized-search. Note: visit using a personal Google Account. Some settings or text may not be 
visible to Google Business Accounts. 

461 “Include your searches on YouTube” (once clicked) in URL: https://myaccount.google.com/activitycontrols. Note: visit using a personal Google Account. 
Some settings or text may not be visible to Google Business Accounts. 

462 ibid. 

463 ibid. 

464 ibid. 
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465 “Include the YouTube videos that you watch” (once clicked) in URL: https://myaccount.google.com/activitycontrols. Note: visit using a personal Google 
Account. Some settings or text may not be visible to Google Business Accounts. 

486 ibid. 

467 “Include the YouTube videos that you watch” (once clicked) in URL: https://myaccount.google.com/activitycontrols. Note: visit using a personal Google 
Account. Some settings or text may not be visible to Google Business Accounts. 

468 ibid. 

469 “YouTube Search History” in “Privacy Checkup” URL: https://myaccount.google.com/privacycheckup. Note: visit using a personal Google Account. Some 
settings or text may not be visible to Google Business Accounts. 

470 https://support.google.com/accounts/answer/6139018. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

471 URL: https://safety.google/privacy/data/. Note: visit using a personal Google Account. Some settings or text may not be visible to Google Business 
Accounts. 

472 ibid. 

473 ibid. 

474 ibid. 

475 “Product price tracking” in URL: https://myactivity.google.com/more-activity. Note: visit using a personal Google Account. Some settings or text may 
not be visible to Google Business Accounts. 

476 URL: https://myactivity.google.com/page?utm_source=my-activity&page=stadia_store. Note: visit using a personal Google Account. Some settings or 
text may not be visible to Google Business Accounts. 

477 ibid. 

478 URL: https://policies.google.com/privacy#footnote-deliver-services. Note: visit using a personal Google Account. Some settings or text may not be 
visible to Google Business Accounts. 

479 ibid. 

480 URL: https://policies.google.com/privacy#footnote-payment-info. Note: visit using a personal Google Account. Some settings or text may not be visible 
to Google Business Accounts. 

481 ibid. 

482 ibid. 

483 URL: https://policies.google.com/privacy#footnote-safety-reliability. Note: visit using a personal Google Account. Some settings or text may not be 
visible to Google Business Accounts. 

484 ibid. 

485 URL: https://www.google.com/chrome/privacy/whitepaper.html#translate 

42° ibid. 
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487 URL: https://www.google.com/chrome/privacy/whitepaper.html#omnibox 

488 ibid. 

489 URL: https://policies.google.com/technologies/partner-sites. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

490 ibid. 

491 URL: https://support.google.com/accounts/answer/3463280. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

492 ibid. 

493 ibid. 

494 “Google Location History” in URL: https://policies.google.com/technologies/location-data. Note: visit using a personal Google Account. Some settings 
or text may not be visible to Google Business Accounts. 

495 See location data collection methods at URL: https://policies.google.com/technologies/location-data#how-find. Note: visit using a personal Google 
Account. Some settings or text may not be visible to Google Business Accounts. 

496 URL: https://policies.google.com/privacy#whycollect. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

497 “Your location information” in URL: https://policies.google.com/privacy#infocollect. Note: visit using a personal Google Account. Some settings or text 
may not be visible to Google Business Accounts. 

498 URL: https://consent.google.com/privacyreminder/signedin. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

499 URL: https://safety.google/privacy/data/. Note: visit using a personal Google Account. Some settings or text may not be visible to Google Business 
Accounts. 

>00 ibid. 

>01 ibid. 

502 “Google Assistant routines” in URL: https://myactivity.google.com/more-activity. Note: visit using a personal Google Account. Some settings or text 
may not be visible to Google Business Accounts. 

93 URL: https://myaccount.google.com/shared-endorsements. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

504 URL: https://myaccount.google.com/u/1/shared-endorsements. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

>05 URL: https://support.google.com/accounts/answer/3403513. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 
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506 URL: https://policies.google.com/privacy#footnote-payment-info. Note: visit using a personal Google Account. Some settings or text may not be visible 
to Google Business Accounts. 

507 ibid. 

>08 URL: https://support.google.com/accounts/answer/1333913. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

509 ibid. 

510 URL: https://www.google.com/chrome/privacy/whitepaper.html#tap 

911 ibid. 

512 ibid. 

513 URL: https://myactivity.google.com/page?utm_source=my-activity&page=match_enrollment. Note: visit using a personal Google Account. Some 
settings or text may not be visible to Google Business Accounts. 

514 ibid. 

515 “Voice and Face Match enrolment” in URL: https://myactivity.google.com/more-activity. Note: visit using a personal Google Account. Some settings or 
text may not be visible to Google Business Accounts. 

516 ibid. 

517 “Include voice and audio recordings” (once clicked) in URL: https://myaccount.google.com/activitycontrols. Note: visit using a personal Google Account. 
Some settings or text may not be visible to Google Business Accounts. 

518 ibid. 

519 ibid. 

520 ibid, 

521 ibid, 

522 URL: https://www.google.com/chrome/privacy/whitepaper.html#signin. Note: visit using a personal Google Account. Some settings or text may not be 
visible to Google Business Accounts. 

523 ibid. 

924 ibid. 

525 ibid. 

526 ibid. 

527 ibid. 

528 ibid. 

529 ibid. 

30 URL: https://policies.google.com/privacy#footnote-deliver-services. Note: visit using a personal Google Account. Some settings or text may not be 
visible to Google Business Accounts. 
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°31 Google’s submission responding to questions for the record from US Congress Judiciary Subcommittee on Antitrust, Commercial, and Administrative 
Law, hearing on “Online platforms and market power, part 2”, 16 July 2019 (URL: https://docs.house.gov/meetings/JU/JU05/20190716/109793/HHRG- 
116-JU05-20190716-SD030.pdf), p. 76. 

932 URL: https://policies.google.com/privacy#footnote-phone-number. Note: visit using a personal Google Account. Some settings or text may not be 
visible to Google Business Accounts. 

533 ibid. 

34 Google’s submission responding to questions for the record from US Congress Judiciary Subcommittee on Antitrust, Commercial, and Administrative 
Law, hearing on “Online platforms and market power, part 2”, 16 July 2019 (URL: https://docs.house.gov/meetings/JU/JU05/20190716/109793/HHRG- 
116-JU05-20190716-SD030.pdf), p. 76. 

535 URL: https://policies.google.com/technologies/types. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

235 ibid. 

537 ibid. 

538 ibid. 

39 URL: https://support.google.com/accounts/answer/7673989. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

940 ibid. 

541 ibid. 

542 URL: https://www.google.com/chrome/privacy/whitepaper.html#usagestats 

543 ibid. 

944 ibid. 

545 ibid. 

946 ibid. 

547 URL: https://www.google.com/chrome/privacy/whitepaper.html#signin 

548 ibid. 

549 ibid. 

°° URL: https://policies.google.com/technologies/partner-sites?hl=en. Note: visit using a personal Google Account. Some settings or text may not be 
visible to Google Business Accounts. 

551 URL: https://policies.google.com/technologies/partner-sites?hl=en. Note: visit using a personal Google Account. Some settings or text may not be 
visible to Google Business Accounts. 

°°? URL: https://policies.google.com/privacy#enforcement. Note: visit using a personal Google Account from within the European Economic Area. Some 
settings or text may not be visible to Google Business Accounts. 
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53 URL: https://policies.google.com/privacy#whycollect. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

554 ibid. 

555 ibid. 

556 ibid. 

557 ibid. 

558 “YouTube survey answers” in URL: https://myactivity.google.com/more-activity. Note: visit using a personal Google Account. Some settings or text may 
not be visible to Google Business Accounts. 

559 ibid. 

60 “Also use your activity & information from Google services to personalize ads on websites and apps that partner with Google to show ads. This stores 
data from websites and apps that partner with Google in your Google Account.” (when clicked) in URL: 
https://adssettings.google.com/authenticated ?hl=en. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

561 ibid. 

>62 Google’s submission responding to questions for the record from US Congress Judiciary Subcommittee on Antitrust, Commercial, and Administrative 
Law, hearing on “Online platforms and market power, part 2”, 16 July 2019 (URL: https://docs.house.gov/meetings/JU/JU05/20190716/109793/HHRG- 
116-JU05-20190716-SD030.pdf), pp. 96-97. 

583 ibid. 

964 ibid. 

>65 URL: https://support.google.com/accounts/answer/6078260. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

566 ibid. 

67 ibid. 

$68 ibid. 

69 Your location information in URL: https://policies.google.com/privacy#infocollect. Note: visit using a personal Google Account. Some settings or text 
may not be visible to Google Business Accounts. 

570 ibid. 

571 URL: https://myaccount.google.com/privacycheckup. Note: visit using a personal Google Account. Some settings or text may not be visible to Google 
Business Accounts. 

572 ibid. 

573 URL: https://support.google.com/websearch/answer/6030020. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 
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574 ibid. 

575 ibid. 

576 See URL: https://support.google.com/gboard/answer/9334583. Note: visit using a personal Google Account. Some settings or text may not be visible to 
Google Business Accounts. 

°’7 Your location information in URL: https://policies.google.com/privacy#infocollect. Note: visit using a personal Google Account. Some settings or text 
may not be visible to Google Business Accounts. 

578 ibid. 

579 ibid. 
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